Subject: CVS commit: pkgsrc/www/firefox
From: Ryo ONODERA
Date: 2018-01-08 10:37:57
Message id: 20180108093757.5312BFBDE@cvs.NetBSD.org

Log Message:
Update to 57.0.4

* Use lang/rust-1.23.0

Changelog:
Speculative execution side-channel attack ("Spectre")

Announced
    January 4, 2018
Reporter
    Jann Horn (Google Project Zero); Microsoft Vunerability Research
Impact
    High
Products
    Firefox
Fixed in
    Firefox 57.0.4

Description

Jann Horn of Google Project Zero Security reported that speculative
execution performed by modern CPUs could leak information through
a timing side-channel attack. Microsoft Vulnerability Research extended
this attack to browser JavaScript engines and demonstrated that code on
a malicious web page could read data from other web sites (violating
the same-origin policy) or private data from the browser itself.

Since this new class of attacks involves measuring precise time intervals,
as a partial, short-term, mitigation we are disabling or reducing
the precision of several time sources in Firefox. The precision of
performance.now() has been reduced from 5us to 20us, and
the SharedArrayBuffer feature has been disabled because it can be
used to construct a high-resolution timer.

SharedArrayBuffer is already disabled in Firefox 52 ESR.

Files:
RevisionActionfile
1.317modifypkgsrc/www/firefox/Makefile
1.305modifypkgsrc/www/firefox/distinfo
1.103modifypkgsrc/www/firefox/mozilla-common.mk
1.1addpkgsrc/www/firefox/patches/patch-servo_components_gfx_font.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_net__traits_response.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_net_fetch_cors__cache.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_net_fetch_methods.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_net_websocket__loader.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_bindings_str.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_blob.rs
1.3addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_cssstyledeclaration.rs
1.3addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_document.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_element.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_htmlelement.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_htmllinkelement.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_htmlmetaelement.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_htmlscriptelement.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_macros.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_namednodemap.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_serviceworkercontainer.rs
1.3addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_servoparser_async__html.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_websocket.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_window.rs
1.3addpkgsrc/www/firefox/patches/patch-servo_components_script_dom_xmlhttprequest.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_selectors_attr.rs
1.3addpkgsrc/www/firefox/patches/patch-servo_components_selectors_parser.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style__traits_viewport.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_attr.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_counter__style_mod.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_custom__properties.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_gecko__string__cache_mod.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_gecko_generated_pseudo__element__definition.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_gecko_pseudo__element__definition.mako.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_properties_longhand_font.mako.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_properties_longhand_pointing.mako.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_servo_selector__parser.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_str.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_stylesheets_viewport__rule.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_mod.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_align.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_angle.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_calc.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_grid.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_length.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_mod.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_percentage.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_text.rs
1.1addpkgsrc/www/firefox/patches/patch-servo_components_style_values_specified_time.rs