palemoon (28.3.1-1devuan) manual; urgency=medium * Initial build for devuan -- B Stack Wed, 23 Jan 2019 13:11:18 -0500 palemoon (28.3.0+repack-1) obs; urgency=medium * Import new 28.3.0 major development and bugfix release: - Added AV1 support for MP4/MSE videos. Please note that this is a reference library implementation and the upstream decoding lib currently has poor performance for higher resolutions (720p+). This is disabled by default; use the about:config preference media.av1.enabled to enable this codec. - Changed the API used for video playback with FFmpeg 58+. This should solve performance issues (dropped frames) with VP8 and VP9. - Redesigned the main toolbar icons as SVG images to make them HiDPI compliant. - Fixed the sync notification (infobar) icon. - Fixed a potential cycle collector resource leak. - Added icons and controls to tabs to indicate if sound is playing the tab and if so, allowing the user to mute it with a click. This is a native implementation of the API in use in Basilisk and performs the same function as the "expose noisy tabs" extension, although the extension may still be preferred by some for e.g. skinning capabilities. The feature may be disabled with browser.tabs.showAudioPlayingIcon. - Removed support for VR hardware. - Fixed out-of-bounds sizes for CSS calculation strings. - Removed the DirectShow component since it is no longer necessary. - Removed Firefox Accounts integration, phase 1: - Changed the Sync client to the one from Tycho. - Made Sync optional at build time. - Stopped trying to cater to addons.mozilla.org since they no longer offer anything useful to Pale Moon after the Great XUL Extension Purge™. - Added an option to process favicons for optimal sized display and removing animations. Enable this with browser.chrome.favicons.process - Fixed an incorrect preference reference in feed reader. - Fixed an issue with lazy frame construction on display:contents elements. This should solve e.g. the use of mathjax in comments on stackoverflow. - Media code improvements and cleanup (ongoing). - Updated the DropBox useragent override to solve login issues. - Fixed potential crashes due to shutdown observers in VTT and font lists. DiD - Enabled some mistakingly-disabled optimizations in the JS JIT compiler. - Fixed several potential crashes in JS. DiD - Fixed several potential crashes in WebCrypto. DiD - Fixed a potential crash in JS Range Analysis. DiD - Fixed a potential crash in the layout engine due to combo boxes. DiD - Fixed a potential shutdown crash in non-standard environments related to 2D Canvas. DiD - Fixed a potential overflow in the PNG writer. DiD - Fixed a potential double-free in the MAR signing utility. DiD - Fixed an issue where URLs could be extracted cross-origin (CVE-2018-18494). - Updated NSPR to v4.20. - Updated NSS to 3.41, providing (among other things) full compatibility with the final version of TLS 1.3 on websites. - Updated location.protocol to the latest spec. - Updated Intersection Observers to the latest spec and enabled them by default. - Updated the SQLite lib to 3.26.0. - Fixed errors about the login manager's recipeManager not being available (yet). - Switched status bar download arrow to SVG. - Fixed a crash in IntersectionObservers. - Fixed initialization of the Search service from browser code to avoid synchronous init. - Added logging of performance warnings to devtools consoles. - Fixed favicons in taskbar tab preview listings. - Blocked Comodo IS dll < version 6.3 to prevent startup crashes. - Fixed issues in the HTML form submit observer module. - Limited resolving depth of CSS variables to a sane maximum (fixes cras.sh issue). - Removed Mozilla's proprietary constructor on WebAudio's AudioContext, aligning it with the standard specification. - Exposed the previously hidden preference in about:config for page thumbnail generation (some people prefer this for local privacy). - Aligned Element.ScrollIntoView with the DOM specification. This improves, among other things, compatibility with the React framework. * Totally revise debian/copyright to conform to Debian Policy. * Install copies of MPL-1.1 and MPL-2 licenses in docs. * Change versioning to "+repack" now that the OBS supports it. -- Steven Pusser Tue, 15 Jan 2019 12:11:18 -0800 palemoon (28.2.2~repack-1~mx17+1) mx; urgency=medium * New upstream minor security and stablility release. -- Steven Pusser Wed, 05 Dec 2018 12:23:18 -0800 palemoon (28.2.1~repack-1~mx17+1) mx; urgency=medium * New release; addresses issues with history and bookmarks. -- Steven Pusser Sun, 18 Nov 2018 11:54:00 -0800 palemoon (28.2.0~repack-1) obs; urgency=medium * Import new 28.2.0 major development and bugfix release: - Fixed a major performance issue with web workers. - Fixed a rare crash on local networks with HTTP basic auth and unsupported cipher suites. - Fixed a performance/timer issue when leaving the browser idle. - Fixed an issue causing an empty dialog when launching executable files from the browser. - Fixed an issue preventing making entries to disallow sites to store data for off-line use. - Removed code to prevent extensions with binary components. - Fixed an issue with common dialogs being sized incorrectly for their content. - Fixed an issue with event handling on the tab bar that would cause frustrating behavior when trying to open/close tabs in rapid succession. - Switched default behavior for scrolling when a context or pop-up menu is open to allow scrolling, like in v27. This also affects scrolling in very long menus, e.g. bookmarks. - Added experimental Asynchronous Panning and Zooming (APZ) for desktop use. - Re-enabled the use and parsing of ICC v4 color profiles. - Removed telemetry code from the caching subsystem. - Improved full-screen detection for suppressing status messages. - Made all arguments passed to Init*Event() optional except the first for parity with other browsers. - Cleaned up some internal installer code. - Fixed making caret width configurable when dealing with CJK characters (regression). - Fixed drawing of table borders consistently when zooming a page (regression). - Exposed the "Save download location per site" pref in about:config. - Improved media handling (ongoing). - Added experimental support for AV1 in WebM videos (disabled by default). - Note: this is for WebM only for now, so MP4 and MSE AV1 streams (e.g. YouTube) will not (yet) play. - Removed the (defunct and incomplete) in-browser translation code. - Fixed an issue with CSS Grid layouts unnecessarily shrinking element blocks. - Fixed notification settings menu entry (opes about:permissions with relevant data now). - Fixed the launching of an undesirable background content process for capturing page thumbnails. - Fixed a focus issue in the bookmark properties dialog. - Changed the setting for reporting CSS errors to the console to false by default, to prevent unnecessary performance loss for recording this data. - Added control mechanisms for Opportunistic Encryption (both for alternative services and upgrade-insecure-requests) in preferences, and disabled this by default due to potential security and privacy issues with this transitional technology. - Updated the default reported Firefox version in Firefox Compatibility Mode to prevent "too old Firefox" complaints on websites. - Updated libnestegg, ffvpx, reader view components and several other modules from upstream. - Implemented security fixes for CVE-2018-12381, CVE-2017-7797, a better fix for CVE-2018-12386 (DiD), CVE-2018-12401 (DiD), CVE-2018-12398, CVE-2018-12392, several Skia bugs, and several crashes and memory safety hazards that do not have a CVE number. * debian/mozconfig: enable AV1 decoding. -- Steven Pusser Mon, 12 Nov 2018 09:38:43 -0800 palemoon (28.1.0~repack-1) obs; urgency=medium * New upstream release: - Updated NSS to 3.38, removed TLS 1.3 draft version check since it's considered final. - Reinstated RC4 as an optional encryption cypher for non-standard environments (e.g. old routing/peripheral networked hardware on LAN). RC4 and 3DES are marked weak and disabled, and will never be used in the first handshake with a site, only as last-ditch fallback when specifically enabled (meaning they won't show up on ssllabs' test, for example). - Removed Telemetry accumulation calls, automatic timers and stopwatches. This removes a very noticeable performance sink for all operations on all platforms. - Fixed many occurrences of discouraged types of memory access for primarily GCC 8 compatibility. This improves overall code security as a defense-in-depth measure. - Re-implemented the pref-controlled custom background color for standalone images. - Updated session history handling for internal pages. about:logopage is no longer stored in history, and you can choose to store the QuickDial page in history by setting the pref browser.newtabpage.add_to_session_history to true. This is disabled by default (meaning you can't use the "Back" button to go back to the QuickDial page) as a defense-in-depth security measure. - Added ui.menu.allow_content_scroll to control whether content can be scrolled if a context menu is open. - Fixed incorrect code removal in ipc. - Removed support for TLS session caches in TLSServerSocket. - Added support for local-ref as SVG xlink:href values. - Changed the find bar to be a browser-global toolbar again (like in Pale Moon 27) instead of per-tab. For people who prefer search terms to be saved on a per-tab basis (like with the per-tab findbar previously), this is possible by setting findbar.termPerTab to true. This resolves a number of issues, including styling with lightweight themes not applying to the find bar, and status pop-ups overlapping the find bar. - Ported all relevant security fixes from Mozilla's Gecko/62 release, including CVE-2018-12377 and CVE-2018-12379. - Restored part of the searchplugin API that was removed by Mozilla, so extensions can provide and save edits to installed search engines. - Improved the speed of restoring browsing sessions upon startup. - Fixed the "Restore previous session" button sometimes being missing from about:home, while a restorable session would be present. - Fixed tab previews in the Windows taskbar (if enabled). - Fixed the setting of the new tab page being "My Home Page" so it'll pick up subsequent changes to the home page URL automatically. - Removed the Firefox Accounts migrator from Sync. - Fixed an issue with the enabled state of number controls if appearances changed. - Stopped building ffvpx on 32-bit platforms (except Windows) to use the (faster) system-installed lib instead. - Re-added a horizontal scroll action option for mouse wheel. (regression) - Fixed handling of content language if the locale is changed. - Fixed document navigation with the F6 key. - Fixed toolbar styling in toolkit themes. - Fixed viewing the source of a selection. * Now has full support for gcc-8, so stop forcing gcc-7 build on Buster and recent Ubuntus where gcc-8 is default. -- Steven Pusser Mon, 17 Sep 2018 19:05:20 -0700 palemoon (28.0.1~repack-1~mx17+1) mx; urgency=medium * New upstream release. - Backed out a Mozilla upstream patch causing issues with IPC and texture allocation for the compositor. - Backed out a Mozilla upstream patch causing issues with Javascript memory buffer allocation. * debian/mozconfig: add an option to tune for the number of parallel build threads. -- Steven Pusser Fri, 31 Aug 2018 17:26:11 -0700 palemoon (28.0.0~repack-3) obs; urgency=medium * Add libavcodec-ffmpeg56 and libavcodec-ffmpeg-extra56 D for Ubuntu 16.04. -- Steven Pusser Sat, 18 Aug 2018 11:19:45 -0700 palemoon (28.0.0~repack-2) obs; urgency=medium * Add alternative libavcodec-extraXX dependencies. -- Steven Pusser Thu, 16 Aug 2018 18:15:14 -0700 palemoon (28.0.0~repack-1) obs; urgency=medium * Import final 28.0.0 release. -- Steven Pusser Wed, 15 Aug 2018 11:55:12 -0700 palemoon (28.0.0~rc1~repack-2) obs; urgency=medium * Depend on a version of libavcodec instead of ffmpeg. * For Buster, build on gcc-7, just to be safe. Restore the lsb-release distro detection setup to rules to enable this, and add the new build-depends. This should no longer be required in 28.1.0. -- Steven Pusser Tue, 14 Aug 2018 12:13:31 -0700 palemoon (28.0.0~rc1~repack-1) obs; urgency=medium * New upstream release. -- Steven Pusser Sun, 12 Aug 2018 13:28:16 -0700 palemoon (28.0.0~b5~repack-1) obs; urgency=medium * Import new beta release. -- Steven Pusser Wed, 01 Aug 2018 14:41:07 -0700 palemoon (28.0~b4~repack-1mx17+1) mx; urgency=medium * New beta release. * Build with native gcc releases, remove lsb-release as build-depend since it's no longer needed to check for the distrelease. * Add libgconf2-dev and libx11-xcb-dev to build-depends. * Add command to dh_auto_clean override to remove pyc files somehow generated by dh_clean. * Add new options to debian/mozconfig. -- Steven Pusser Sat, 28 Jul 2018 15:06:18 -0700 palemoon (27.9.4~repack-1~mx17+1) mx; urgency=medium * Import new upstream 27.9.4 release. - Updated the useragent for addons.mozilla.org to work around their "Only with Firefox" discrimination preventing users from downloading themes, old versions of extensions, and other files with Pale Moon. - Restricted web access to the moz-icon:// scheme that could potentially be abused to infringe the user's privacy. - Prevented various location-based threats. DiD - Fixed a potential vulnerability with plugins being redirected to different origins (CVE-2018-12364). - Improved the security check for launching executable files (by association) on Windows from the browser. For users who have (most likely accidentally) granted a system-wide waiver for opening these kinds of files without being prompted, this permission has been reset. - Fixed an issue with invalid qcms transforms (CVE-2018-12366). - Fixed a buffer overflow using the computed size of canvas elements (CVE-2018-12359). - Fixed a use-after-free when using focus() (CVE-2018-12360). - Added some sanity checks on nsMozIconURI. DiD - Fixed an issue in the case the preferences file in the profile would not be writable (e.g. temporary permission issues due to backup, virus scanning or similar external processes). -- Steven Pusser Wed, 11 Jul 2018 13:59:46 -0700 palemoon (27.9.3~repack-1~mx17+1) mx; urgency=medium * New upstream security update: - Changes/fixes: - (CVE-2017-0381) Ported a patch from libopus upstream. Note, contrary to that report, the libopus maintainers state they don't believe remote code execution was possible, so this was not a critical patch. - Fixed an issue with task counting in JS GC. - Fixed a use-after-free in DOMProxyHandler::EnsureExpandoObject (thanks to Berk Cem Göksel for reporting). -- Steven Pusser Tue, 12 Jun 2018 11:12:06 -0700 palemoon (27.9.2~repack-1~mx17+1) mx; urgency=medium * New upstream security and stability update: - Changes/fixes: - We changed the language strings for softblocked items so people will cry less when we do our job. - (CVE-2018-5174) Prevent potential SmartScreen bypass on Windows 10. - (CVE-2018-5173) Fixed an issue in the Downloads panel improperly rendering some Unicode characters, allowing for the file name to be spoofed. This could be used to obscure the file extension of potentially executable files from user view in the panel. - (CVE-2018-5177) Fixed a vulnerability in the XSLT component leading to a buffer overflow and crash if it occurs. - (CVE-2018-5159) Fixed an integer overflow vulnerability in the Skia library resulting in possible out-of-bounds writes. - (CVE-2018-5154) Fixed a use-after-free vulnerability while enumerating attributes during SVG animations with clip paths. - (CVE-2018-5178) Fixed a buffer overflow during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable extension in order to occur. - Fixed several stability issues (crashes) and memory safety hazards. -- Steven Pusser Mon, 21 May 2018 11:43:14 -0700 palemoon (27.9.1~repack-1) obs; urgency=medium * New upstream maintenance update: - Removed the unused/incomplete places protocol handler. - Worked around an issue with MSE media without a Track ID. This should help with the playability of some live streams. - Ported across jemalloc improvements from UXP. - Ported across cairo mutex improvements from UXP. - Added support for FFmpeg 4.0/libavcodec 58. - Added a fix for Windows 10's "isAlpha()" not being what one would expect in v1803. -- Steven Pusser Mon, 07 May 2018 15:07:33 -0700 palemoon (27.9.0~repack-1~mx17+1) mx; urgency=medium * New upstream release: - Fixed a number of spec compliance issues in our media subsystem. - Added a trailing slash to referrers when policy is set to fix some web compatibility issues. - Fixed the property order in Object.getOwnPropertyNames(string) and others for web compatibility. - Updated RegExp(RegExp object, flags) to the ES6 standard specification. - Changed the embedded font from the no longer free EmojiOne to the open-licensed Twemoji (with additional fixes). This also further extends unicode support to Unicode 10 emoji(s). Please note that as a result, color emoji(s) will look different than before. - Adjusted some things in our memory allocator code to provide, among other things, better allocation alignment on Windows. - Made the attempt to migrate people from the old sync server domain name to the current one more aggressive. We will be retiring the old pmsync.palemoon.net Sync server address shortly to remove the need for us to maintain a security certificate for it; this preference migration should automatically put everyone on the correct server address when upgrading. - Made reading of the sessionstore synchronous, to speed up startup and prevent the homepage from being loaded when restoring a session. - Added a fix to switch to the correct window/tab when a web notification is clicked. - Changed the placeholder text to not include "Search" when all search functions from the address bar are disabled. - Enabled the use of Skia for canvas on Linux and OSX. - Worked around a potential cause for some non-standard bitmapped fonts ending up with incorrect line heights (I'm looking at you, Noto fonts!). - Added a workaround for incorrectly-encoded JPEG-XR images with planar alpha. Ultimately, the jxrlib reference implementation should be fixed to encode according to spec. - Aligned XCTO:nosniff allowed script MIME types with the updated spec. - Improved the logic for storing vector images in the surface cache. - Fixed character set handling for XMLHttpRequests. -- Steven Pusser Tue, 17 Apr 2018 10:14:19 -0700 palemoon (27.8.3~repack-1) obs; urgency=medium * New upstream bugfix update: - This is a small update to solve a pervasive crash in responsive web layouts. -- Steven Pusser Thu, 29 Mar 2018 12:48:14 -0700 palemoon (27.8.2~repack-1) obs; urgency=medium * New upstream security update: - Privacy fix: prevented update checks for the default theme. - Added a user-agent override for Dropbox to improve compatibility with their service. - Fixed an issue with mouseover handling related to (CVE-2018-5103). DiD - Disabled the Mac OSX Nano allocator. DiD - Fixed (CVE-2018-5129) OOB Write. - Updated the lz4 library to 1.8.0 to solve potential issues. DiD - Fixed (CVE-2018-5137) Path traversal on chrome:// URLs - Fixed several memory safety an synchronicity hazards. -- Steven Pusser Thu, 22 Mar 2018 10:31:24 -0700 palemoon (27.8.1~repack-1) obs; urgency=medium * New upstream release: - Backed out the NSPR/NSS update from 27.8.0 for causing crashes, general operational instability and handshake issues. - Disabled TLS 1.3 draft support by default, because with the NSS backout we only support an older draft right now that is no longer current and may cause connectivity issues. You can manually re-enable it at your own risk in about:config by setting security.tls.version.max to 4. -- Steven Pusser Tue, 06 Mar 2018 12:04:10 -0800 palemoon (27.8.0~repack-1) obs; urgency=medium * New upstream release: - Added support for emojis on Windows systems that have relatively poor support for them with standard font sets by including our own font (EmojiOne based for now). - Added a setting in preferences to select the use of tab previews with Ctrl+Tab. - Added Eyedropper menu entry to the AppMenu. - Added a preference to control whether the text cursor (caret) should be thicker when dealing with CJK characters or not (default = yes). - Added URL fix-ups for schemes (mis-typed "ttp://" etc.). - Added support for ES6 "Symbol species". - Updated our TLS 1.3 support to the latest (probably final) draft. - Fixed gap inconsistency in the tabstrip. - Fixed a number of browser crashes. - Fixed a crash with the exponentiation operator "**" - Set the performance timer granularity to 1 ms. - Updated the kiss-fft library to our forked 1.4.0 version. - Disabled a potentially problematic optimization on Win 8+ with high contrast themes in use. - Removed the notification bar when in full screen to prevent unwanted visible screen elements. - Removed unmaintained and insecure WebRTC code - building with WebRTC enabled is no longer an option. - Removed redundant checks for "Vista or later" since that is all we support. - Added display of the http status to raw request displays. - Added a workaround for cloned videos not retaining their muted state. - Added a temporary workaround to avoid crashes on trackless media. - Removed some superfluous ellipses from menu labels. - Fixed undesired shrinking of line heights as a result of setting minimum font size in preferences. - Fixed some issues with setting the new tab preference (regression). * Add support for building on Debian Buster on gcc-4.9. -- Steven Pusser Fri, 02 Mar 2018 17:38:20 -0800 palemoon (27.7.2~repack-1~mx17+1) mx; urgency=medium * New upstream release: - Changed the X-Content-Type-Options: nosniff behavior to only check "success" class server responses, for web compatibility reasons. - Changed the perfomance timer resolution once more to a granularity of 1 ms, after evaluating more potential ways of abusing Spectre. This takes the most cautious approach possible lacking more information (because apparently NDAs have been signed over this between mainstream players), follows Safari's lead, and should make it not just infeasible but downright impossible to use these timers for nefarious purposes in this context. - Improved the debug-only startup cache wrapper to prevent a rare crash. - Fixed a crash in the XML parser. - Added a check for integer overflow in AesTask::DoCrypto() (CVE-2018-5122) DiD - Fixed a potential race condition in the browser cache. - Fixed a crash in HTML media elements (CVE-2018-5102) - Fixed a crash in XHR using workers. - Fixed a crash with some uncommon FTP operations. - Fixed a potential race condition in the JAR library. -- Steven Pusser Thu, 01 Feb 2018 13:48:26 -0800 palemoon (27.7.1~repack-1~mx17+1) mx; urgency=medium * New upstream release: - Added support for Array.prototype[@@unscopables]. Unfortunately, the addition of Javascript's ES6 Unscopables in 27.7.0 was incomplete, which caused a number of websites (e.g. Chase on-line banking, some Russian government sites) to display blank or not complete loading after updating to that version of the browser. This update should fix the problem by adding the missing part of the feature. - Fixed an issue with the default theme causing tab borders to be drawn too thick at higher settings for visual element scaling (125/150%) in Windows. -- Steven Pusser Thu, 18 Jan 2018 10:03:02 -0800 palemoon (27.7.0~repack-1~mx17+1) mx; urgency=medium * New upstream release: - Reorganized access to preferences (moved to the Tools menu on Linux, and renamed from "Options" to "Preferences" on Windows). - Renamed "Restart with add-ons disabled" to "Restart in Safe Mode" to better reflect what it does. - Worked around an issue with some improperly-encoded PNG files not decoding after our libpng update. - Fixed an issue on Mac builds not properly populating the application menu. - Added "My home page" as an option for new tabs. - Added an option to disable the 4th and 5th mouse buttons (Windows). - (mouse.button4.enabled and mouse.button5.enabled, respectively) - Improved the resetting of non-default profiles. - Fixed an issue with details/summary having the incorrect height if floated, breaking layouts. - Implemented support for flex/columnset contents inside buttons to align its behavior with other browsers. - (this should fix layout issues with Twitch's new web interface) - Made several more improvements to the details/summary tags to align them with the current spec and fix several bugs. - Fixed an issue where CSS clone operations would draw a border. - Changed the way fractional border widths are rounded to provide more natural behavior. - Fixed an issue where number inputs would incorrectly be flagged as read-only. - Added assets for tile display in the Windows start panel. - Finished sync infra swapover by adding a one-time pref migration for server used. - Improved WebAudio API: Return the connected audio node from AudioNode.connect() - Added support for a default playback start position in media elements. - Fixed an assert in cubeb-alsa code (Linux). - Added support for media cue-change events (e.g. subtitles). - Updated SQLite to 3.21.0. - Fixed a crash when trying to use the platform embedded. - Fixed devtools (gcli) screenshots on vertical-text pages. - Fixed devtools copy as cURL for POST requests. - Improved the HTML editor component (several bugfixes). - Added support for ES7's exponentiation a ** b operator. - Fixed an issue with arrow functions incorrectly creating an arguments binding. - Added Javascript's ES6 unscopables. Security/privacy fixes: - Disabled automatic filling in of log-in details by default to prevent potential risks of credentials being abused (e.g. for tracking) or stolen. - Added a preference (in the category security) to easily enable or disable automatic filling in of log-in data. - Removed the sending of referrers when opening a link in a new private window. - Added an option to disable the page visibility Web API (dom.visibilityAPI.enabled), allowing users to prevent pages from knowing whether they are being actively displayed to the user or not. - Removed the "ask every time" policy for cookies. For granular control, please use any of the excellent available extensions to regulate cookie use on a per-site or per-url basis. - Added support for X-Content-Type-Options: nosniff (for scripts). - Changed the resolution of performance timers to a level where any future potential abuse for hardware-timing attacks becomes impractical. -- Steven Pusser Tue, 16 Jan 2018 12:02:55 -0800 palemoon (27.6.2~repack-1) obs; urgency=medium * Minor security and bugfix release: - Implemented the concept of so-called "cookie-averse document objects", which is a security&privacy measure that blocks certain web content from setting cookies. This mitigates cookie-injection, which might help against "hidden" cookie tracking. - Mitigated some domain name spoofing through IDN by using dotless-i and dotless-j with accents. (CVE-2017-7832) - Pale Moon will display these kinds of spoofed domains in punycode now in the actual address bar. Please note that the identity panel will always be able to help you on secure sites when IDNs are in use to notice potential spoofing, as opposed to relying on detection algorithms in the URL itself. As such, some other issues like CVE-2017-7833 are already mitigated by us. - Fixed an issue with mixed-content blocking. (CVE-2017-7835) - Added an extra check for the correct signature data type on certificates. - Added missing sanitization in exporting bookmarks to HTML. (CVE-2017-7840) - Fixed several crashes and memory safety hazards. * Bump debhelper build-depend to >= 9. -- Steven Pusser Wed, 29 Nov 2017 12:31:22 -0800 palemoon (27.6.1~repack-1mx15+1) mx; urgency=medium * Minor bugfix release: - Fixed a regression with new windows (opening two windows from the command-line or file association, focus issues on new windows, not loading the home page in a new window, etc.) - Aligned XHR with the currect spec to allow withCredentials. - Fixed an input element focus issue within handlers. - Fixed the processing of all-padding HTTP/2 frames to prevent rare HTTP/2 hangups. - Updated CitiBank override to work around their login issues. - Updated Netflix override to a community-supplied one that seems to satisfy their arbitrary restrictions better. -- Steven Pusser Mon, 20 Nov 2017 15:52:34 -0800 palemoon (27.6.0~repack-1) obs; urgency=medium * Major development update; changes can be viewed at https://github.com/MoonchildProductions/Pale-Moon/releases. * debian/mozconfig: add vectorization flags for distreleases that support it. Those that don't get the mozconfig without the flags. -- Steven Pusser Wed, 08 Nov 2017 11:10:24 -0800 palemoon (27.5.1~repack-1) obs; urgency=medium * Minor bugfix release: - Changed the default Windows 10 styling when no accent color is applied to black-on-white. - Changed the theme styling on Windows 10 when the system window frame is used (menu bar enabled) to use the window manager background directly, preventing visual lag updating the window color when it changes. - Updated user agent overrides for DropBox, YouTube and Yahoo to work around user agent sniffing issues. - Fixed a crash in the media subsystem. - Fixed a regression where video playback hardware acceleration was disabled incorrectly on some systems. -- Steven Pusser Fri, 13 Oct 2017 15:15:01 -0700 palemoon (27.5.0~repack-1mx15+1) mx; urgency=medium * New upstream major release, changes can be viewed at https://github.com/MoonchildProductions/Pale-Moon/releases. * Disable updater and installer in mozconfig. -- Steven Pusser Tue, 26 Sep 2017 18:32:35 -0700 palemoon (27.4.2~repack-1) obs; urgency=medium * New upstream bugfix release: - Fixed a number of crashes. - Enabled the opt-in debugging feature to log SSL keys to a file in all builds. - Added a fix for TLS 1.3 handshakes causing a browser hangup. - Handshakes should be considerably faster now and no longer stall in the wrong circumstances. - Updated NSPR to 4.15. - Updated NSS to 3.31.1. - Fixed a DoS issue using overly long Username in URL scheme (CVE-2017-7783) - Fixed an issue where (cross domain) iframes could break scope (CVE-2017-7787) - Fixed an issue in WindowsDllDetourPatcher (CVE-2017-7804) - Fixed an issue with elliptic curve addition in mixed Jacobian-affine coordinates (CVE-2017-7781) - Fixed a UAF in nsImageLoadingContent (CVE-2017-7784) - Fixed a UAF in WebSockets (CVE-2017-7800) - Fixed a heap-UAF in RelocateARIAOwnedIfNeeded (CVE-2017-7809) DiD (accessibility is disabled) -- Steven Pusser Wed, 23 Aug 2017 15:50:07 -0700 palemoon (27.4.1~repack-1mx15+1) mx; urgency=medium * New upstream bugfix release: - Fixed an issue where MSE media playback would not use hardware acceleration when it could, causing choppy playback and high CPU usage. - Fixed ES6 iterator chains to be spec-compliant. - Fixed ES6 vector append calls and some related memory leaks. - Added a workaround to reduce the chances of a rare crash occurring. -- Steven Pusser Fri, 04 Aug 2017 18:22:19 -0700 palemoon (27.4.0~repack-2) obs; urgency=medium * debian/mozconfig: drop deprecated "--disable-gstreamer" option. -- Steven Pusser Wed, 12 Jul 2017 13:25:27 -0700 palemoon (27.4.0~repack-1) obs; urgency=medium * New upstream release--the github 27.4.0 was not a real release: Changes/fixes: - Completely re-worked the Media Source Extensions code to make it spec compliant, and asynchronous as per specification for MSE with MP4. This should fix playback problems on YouTube, Twitch, Vimeo and other sites that previously had some issues. A massive thank you to Travis for his tireless work on making this happen! Please note that MSE+WebM (disabled by default) is not using this new code yet (planned for the next release), and as such there is a temporary set of things to keep in mind if you don't use default settings: If you have previously enabled MSE+WebM, this setting will be reset when you update to avoid conflicting settings with the updated MSE code. We've added an extra setting in Options to disable the updated MSE code (asynchronous use) in case you need to use WebM or are otherwise having issues with the updated code (please let us know in that case). Once again, the MSE+WebM and Asynchronous MSE use are currently mutually exclusive. You can have one or the other, not both, until we sort out the code for WebM. To enable MSE+WebM you will first have to disable Asynchronouse MSE in settings (otherwise the WebM setting will be greyed out and disabled). - Added a control in options/preferences for HSTS and HPKP usage. - Changed HTML bookmark exports to write CRLF line endings to the file on Windows. - Leveraged multi-core rendering for libVPX (VP8/VP9 WebM decoding). - Fixed some issues accessing DeviantArt (useragent-sniffing). - Aligned CSS text-align with the spec. - Added a recovery module for browser initialization issues (e.g. when using a wrong language pack). - Fixed spurious console errors for XHR requests with certain http response codes. - Enabled v-sync aligned refresh for a smoother scrolling experience. - Removed support for CSS XP-theme media queries. - Improved console error reporting. - Fixed resetting toolbars and controls from the safe mode dialog. - Fixed bookmark recovery option from the safe mode dialog. - Fixed innerText getters for display:none elements. - Fixed a GL buffer crash that might occur with certain combinations of drivers and hardware. - Added some more details to about:support. - Fixed a potential crash when the last audio device is removed during playback. - Fixed a crash on about:support when windowless browsers are created. - Updated