* Thu Apr 10 2025 Michael Gorse <mgorse@suse.com>
- Add libtheora-avoid-negative-shift.patch: avoid negative shift in
huffdec.c (bsc#1234837 CVE-2024-56431).
* Wed Dec 11 2024 Cliff Zhao <qzhao@suse.com>
- Add mozjs115-CVE-2024-11498.patch:
Backporting bf4781a2 from upstream, Check height limit in modular
trees. Also rewrite the implementation to use iterative checking
instead of recursive checking of tree property values, to ensure
stack usage is low. Before, it was possible for
appropriately-crafted files to use a significant amount of stack.
(CVE-2024-11498, bsc#1233786)
* Mon Dec 09 2024 Cliff Zhao <qzhao@suse.com>
- Add mozjs115-CVE-2024-11403.patch:
Backporting 9cc451b9 from upstream, Port the Huffman lookup table
size fix from brunsli.
(CVE-2024-11403, bsc#1233766)
* Thu Dec 05 2024 Cliff Zhao <qzhao@suse.com>
- Add mozjs115-CVE-2024-50602.patch:
Backporting 51c70190 from upstream,
* lib: Make XML_StopParser refuse to stop/suspend an unstarted parser.
* lib: Be explicit about XML_PARSING in XML_StopParser.
(CVE-2024-50602, bsc#1232599, bsc#1232602)
* Wed Nov 20 2024 Bjørn Lie <bjorn.lie@gmail.com>
- Fix build against icu 76.1: link the correct libraries (icu-uc
instead of icu-i18n).
* Mon Oct 21 2024 Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 115.15.0:
+ Various security fixes and other quality improvements.
- This is the last version from Mozilla, please port to newer
versions: At minimum version 128.
* Mon Sep 30 2024 Cliff Zhao <qzhao@suse.com>
- Add mozjs115-CVE-2024-45492.patch:
Backporting 9bf0f2c1 from libexpat upstream, Detect integer
overflow in function nextScaffoldPart.
(CVE-2024-45492, bsc#1230038)
* Mon Sep 30 2024 Cliff Zhao <qzhao@suse.com>
- Add mozjs115-CVE-2024-45491.patch:
Backporting 8e439a99 from libexpat upstream, Detect integer
overflow in dtdCopy.
(CVE-2024-45491, bsc#1230037)
* Mon Sep 30 2024 Cliff Zhao <qzhao@suse.com>
- Add mozjs115-CVE-2024-45490-part01-5c1a3164.patch:
Backporting 5c1a3164 from libexpat upstream, Reject negative len
for XML_ParseBuffer.
CVE-2024-45490's fixes including 3 parts: 5c1a3164 for libexpat
sources; c12f039b for libexpat tests; 2db23301 for libexpat docs;
Because mozjs only embeds libexpat sources, so unnecessary to
port prart02 and part03.
(CVE-2024-45490, bsc#1230036)
* Thu Apr 04 2024 Dominique Leuenberger <dimstar@opensuse.org>
- Properly tag patches.