Subject: CVS commit: [pkgsrc-2021Q3] pkgsrc/www/firefox91
From: Benny Siegert
Date: 2021-11-05 20:28:53
Message id: 20211105192853.43463FAEC@cvs.NetBSD.org

Log Message:
Pullup ticket #6530 - requested by nia
www/firefox91: security fix

Revisions pulled up:
- www/firefox91/Makefile                                        1.8
- www/firefox91/PLIST                                           1.3
- www/firefox91/distinfo                                        1.6
- www/firefox91/patches/patch-modules_fdlibm_src_math__private.h 1.1

---
   Module Name:	pkgsrc
   Committed By:	nia
   Date:		Wed Nov  3 19:19:40 UTC 2021

   Modified Files:
   	pkgsrc/www/firefox91: Makefile PLIST distinfo
   Added Files:
   	pkgsrc/www/firefox91/patches: patch-modules_fdlibm_src_math__private.h

   Log Message:
   firefox91: update to 91.3.0

   Security Vulnerabilities fixed in Firefox ESR 91.3

       #CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets

       #CVE-2021-38504: Use-after-free in file picker dialog

       #CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode
       without notification or warning

       #CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass
       the Same-Origin-Policy on services hosted on other ports

       #MOZ-2021-0008: Use-after-free in HTTP2 Session object

       #CVE-2021-38508: Permission Prompt could be overlaid, resulting in user
       confusion and potential spoofing

       #CVE-2021-38509: Javascript alert box could have been spoofed onto an
       arbitrary domain

       #CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac
       OS

       #MOZ-2021-0007: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

Files:
RevisionActionfile
1.5.2.2modifypkgsrc/www/firefox91/Makefile
1.2.2.1modifypkgsrc/www/firefox91/PLIST
1.2.2.2modifypkgsrc/www/firefox91/distinfo
1.1.2.2addpkgsrc/www/firefox91/patches/patch-modules_fdlibm_src_math__private.h