Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK)) by mollari.NetBSD.org (Postfix) with ESMTPS id 4838E7A16C for ; Tue, 20 Sep 2016 20:01:47 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id E3D5D85EB4; Tue, 20 Sep 2016 20:01:46 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 431FC85EB3 for ; Tue, 20 Sep 2016 20:01:46 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id xxrlVD88HS4H for ; Tue, 20 Sep 2016 20:01:41 +0000 (UTC) Received: from cvs.NetBSD.org (unknown [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 9F8F085E46 for ; Tue, 20 Sep 2016 20:01:41 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 9A1C8FBD1; Tue, 20 Sep 2016 20:01:41 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_147440170192310" MIME-Version: 1.0 Date: Tue, 20 Sep 2016 20:01:41 +0000 From: "Ryo ONODERA" Subject: CVS commit: pkgsrc/www/firefox To: pkgsrc-changes@NetBSD.org Reply-To: ryoon@netbsd.org X-Mailer: log_accum Message-Id: <20160920200141.9A1C8FBD1@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk This is a multi-part message in MIME format. --_----------=_147440170192310 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" Module Name: pkgsrc Committed By: ryoon Date: Tue Sep 20 20:01:41 UTC 2016 Modified Files: pkgsrc/www/firefox: Makefile PLIST distinfo mozilla-common.mk pkgsrc/www/firefox/patches: patch-build_gyp.mozbuild patch-build_moz.configure_old.configure patch-js_src_jit_none_AtomicOperations-sparc.h patch-mozglue_build_arm.cpp Added Files: pkgsrc/www/firefox/patches: patch-toolkit_modules_GMPUtils.jsm patch-toolkit_moz.configure patch-toolkit_mozapps_extensions_test_browser_browser__gmpProvider.js Removed Files: pkgsrc/www/firefox/patches: patch-gfx_skia_skia_src_core_SkScaleToSides.h patch-js_src_jit_AtomicOperations.h Log Message: Update to 49.0 Changelog: New Updated Firefox Login Manager to allow HTTPS pages to use saved HTTP logins. It’s one more way Firefox is supporting Let’s Encrypt and helping users transition to a more secure web. Added features to Reader Mode that make it easier on the eyes and the ears Controls that allow users to adjust the width and line spacing of text Narrate, which reads the content of a page out loud Improved video performance for users on systems that support SSSE3 without hardware acceleration Added context menu controls to HTML5 audio and video that let users loops files or play files at 1.25x speed Enhancements for Mac users Improved performance on OS X systems without hardware acceleration Improved appearance of anti-aliased OS X fonts Improvements in about:memory reports for tracking font memory usage Improve performance on Windows systems without hardware acceleration Fixed Fixed an issue that prevented users from updating Firefox for Mac unless they originally installed Firefox. Now, those users as well as any user with administrative credentials can update Firefox. Various security fixes Changed Ended Firefox for Mac support for OS X 10.6, 10.7, and 10.8. Ended Firefox for Windows support for SSE processors Removed Firefox Hello Re-enabled the default for Graphite2 font shaping Developer Added a Cause column to the Network Monitor to show what caused each network request Introduced web speech synthesis API Fixed in Firefox 49 2016-85 Security vulnerabilities fixed in Firefox 49 CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low] Reporter: Atte Kettunen Description: A content security policy (CSP) containing a referrer directive with no values can cause a non-exploitable crash. [1289085] CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high] Reporter: Atte Kettunen Description: An out-of-bounds write of a boolean value during text conversion with some unicode characters. [1291016] CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low] Reporter: Abhishek Arya Description: An out-of-bounds read during the processing of text runs in some pages using display:contents. [1288946] CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high] Reporter: Abhishek Arya Description: A bad cast when processing layout with input elements can result in a potentially exploitable crash. [1297934] CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high] Reporter: Nils Description: A potentially exploitable crash in accessibility [1280387] CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high] Reporter: Nils Description: A use-after-free vulnerability triggered by setting a aria-owns attribute [1287721] CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high] Reporter: Nils Description: A use-after-free issue in web animations during restyling. [1282076] CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high] Reporter: Nils Description: A user-after-free vulnerability with web animations when destroying a timeline [1291665] CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical] Reporter: Nils Description: A buffer overflow when working with empty filters during canvas rendering [1287316] CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical] Reporter: Nils Description: A potentially exploitable crash caused by a buffer overflow while encoding image frames to images [1294677] CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate] Reporter: Rafael Gieschke Description: The full path to local files is available to scripts when local files are drag and dropped into Firefox [1249522] CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high] Reporter: Mei Wang Description: Use-after-free vulnerability when changing text direction [1289970] CVE-2016-5281 - use-after-free in DOMSVGLength [high] Reporter: Brian Carpenter Description: Use-after-free vulnerability when manipulating SVG format content through script [1284690] CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate] Reporter: Richard Newman Description: Favicons can be loaded through non-whitelisted protocols, such as jar: [932335] CVE-2016-5283 -