| Message ID | 20240817193240.27089-1-ian@retrospec.tv |
|---|---|
| Headers | show |
| Series | Update LibreWolf to 129.0.1-1; add nss-rapid | expand |
On 2024-08-17, Ian Eure wrote: > - Updates LibreWolf to 129.0.1-1, the latest upstream. > - Updates nss-rapid, to version 3.103, the latest upstream. > - Adds the skr locale to all-mozilla-locales. > - Backs out improvements not directly related to updating the browser version, to make review easier. It builds and runs fine for me, so overall I think this should be merged sooner than later (despite some of my minor comments on the nss-rapid patch)... given the previous iterations of patches over several months and the growing list of CVE fixes... If there are no strong objections and nobody beats me to it, I will merge these patches in the next couple days. Thanks for working on librewolf! Sorry the update process has been lagging! live well, vagrant
On 2024-08-17, Vagrant Cascadian wrote: > On 2024-08-17, Ian Eure wrote: >> - Updates LibreWolf to 129.0.1-1, the latest upstream. >> - Updates nss-rapid, to version 3.103, the latest upstream. >> - Adds the skr locale to all-mozilla-locales. >> - Backs out improvements not directly related to updating the browser version, to make review easier. > > It builds and runs fine for me, so overall I think this should be merged > sooner than later (despite some of my minor comments on the nss-rapid > patch)... given the previous iterations of patches over several months > and the growing list of CVE fixes... > > If there are no strong objections and nobody beats me to it, I will > merge these patches in the next couple days. Pushed as 58faaf4eaadafa09a97ab31103eb54bd2076a699. live well, vagrant
vs. the previous versions of this patch series, v6: - Updates LibreWolf to 129.0.1-1, the latest upstream. - Updates nss-rapid, to version 3.103, the latest upstream. - Adds the skr locale to all-mozilla-locales. - Backs out improvements not directly related to updating the browser version, to make review easier. In addition to the CVEs fixed in 128.0, this includes fixes for[1]: CVE-2024-7518: Fullscreen notification dialog can be obscured by document content CVE-2024-7519: Out of bounds memory access in graphics shared memory handling CVE-2024-7520: Type confusion in WebAssembly CVE-2024-7521: Incomplete WebAssembly exception handing CVE-2024-7522: Out of bounds read in editor component CVE-2024-7523: Document content could partially obscure security prompts CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims CVE-2024-7525: Missing permission check when creating a StreamFilter CVE-2024-7526: Uninitialized memory used by WebGL CVE-2024-7527: Use-after-free in JavaScript garbage collection CVE-2024-7528: Use-after-free in IndexedDB CVE-2024-7529: Document content could partially obscure security prompts CVE-2024-7530: Use-after-free in JavaScript code coverage collection CVE-2024-7531: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge [1]: https://www.mozilla.org/en-US/security/advisories/mfsa2024-33/ Ian Eure (3): gnu: gnuzilla: Add skr to all-mozilla-locales. gnu: Add nss-rapid. gnu: librewolf: Update to 129.0.1-1. gnu/packages/gnuzilla.scm | 1 + gnu/packages/librewolf.scm | 12 +++---- gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 74 insertions(+), 6 deletions(-) -- 2.45.2