Fixes CVEs 2024-9392, 2024-9393, 2024-9394 and 2024-9401. See the Mozilla
Foundation Security Advisory
<https://www.mozilla.org/en-US/security/advisories/mfsa2024-48/> for details.
* gnu/packages/tor-browsers.scm (%mullvadbrowser-build-date): Update to
20240930230510.
(%mullvadbrowser-version): Update to 13.5.6.
(%mullvadbrowser-firefox-version): Update to 115.16.0esr-13.5-1-build2.
(mullvadbrowser-translation-base): Update to
a142f78af87f994913faa15fb4b0f34f0ce1a22b.
(mullvadbrowser-translation-specific): Update to
78212a3da2439e436ac5f73d8e3eb908145c3ece.
Change-Id: Id65315c9aa829815e00dcfe74098680654592f20
Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
Updates the package and changes how the .desktop file is generated. The
.desktop file the package had been using was removed upstream.
Fixes:
CVE-2024-9391: Prevent users from exiting full-screen mode in Firefox Focus
for Android
CVE-2024-9392: Compromised content process can bypass site isolation
CVE-2024-9393: Cross-origin access to PDF contents through multipart responses
CVE-2024-9394: Cross-origin access to JSON contents through multipart
responses
CVE-2024-9395: Specially crafted filename could be used to obscure download
type
CVE-2024-9396: Potential memory corruption may occur when cloning certain
objects
CVE-2024-9397: Potential directory upload bypass via clickjacking
CVE-2024-9398: External protocol handlers could be enumerated via popups
CVE-2024-9399: Specially crafted WebTransport requests could lead to denial of
service
CVE-2024-9400: Potential memory corruption during JIT compilation
CVE-2024-9401: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
CVE-2024-9402: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
Thunderbird 131, and Thunderbird 128.3
CVE-2024-9403: Memory safety bugs fixed in Firefox 131 and Thunderbird 131
CVE-2024-9680: Use-after-free in Animation timeline
* gnu/packages/librewolf.scm (%librewolf-build-id): Update.
(librewolf): Update to 131.0.2-1.
[arguments]<#:phases>: Adjust 'install-desktop-entry for new .desktop file.
Change-Id: I03f8a405c454a5bc3c8a1fc9f94d0ec9b41e92ec
Modified-by: Hilton Chain <hako@ultrarare.space>
Signed-off-by: Hilton Chain <hako@ultrarare.space>
* gnu/packages/task-management.scm (todoman): Update to 4.4.0.
[build-system]: Use pyproject-build-system.
[arguments]: Remove not needed patch-tests phase and remove unused arguments
to check phase.
[native-inputs]: Remove python-setuptools-scm. Add python-pytz,
python-hypothesis, and python-pytest-runner. Indent by one space instead of
two.
[propagated-inputs]: Indent by one space instead of two.
Change-Id: I07cf40cecda4e9fea149204a6d30438b15233ef9
* gnu/packages/lisp-xyz.scm (sbcl-flamegraph): Update to 0b78cae.
[source]: Update url back to upstream since merged.
Change-Id: Id4c45a176e8ef927eca82e02bf33a44cd958f386
This is a follow-up to commit 06d01c610e ("services: gdm: Enable wayland by
default."), which forgot updating the associated documentation.
Change-Id: I3ea0402680e3e0f588db057988eb00af44ab4ae6
This patch fixes a reported bug where context (right-click) menus contain many
duplicate and incorrect entries.
* gnu/packages/librewolf.scm (librewolf)
[phases] <neuter-genai>: Reinstate the genai browser component.
Change-Id: I288545ce80b9a7e854edfc26a7ffe43433303458
* gnu/packages/admin.scm (jc): Update to 1.25.3.
[arguments]<phases>: In "hack-time-zone" phase, set the TZ environment
variable instead of substituting the timezone in tests.
Change-Id: Ib1df51435ac8ed78ddbbaac2953dec00cbc71b85
Signed-off-by: jgart <jgart@dismail.de>
* gnu/packages/python-xyz.scm (python-angr): Update to 9.2.112.
[propagated-inputs]: Remove python-progressbar2; add python-pyformlang,
add python-rich, add python-unique-log-filter.
* gnu/packages/patches/python-angr-addition-type-error.patch:
Remove patch (merged upstream and included in new release).
* gnu/packages/patches/python-angr-check-exec-deps.patch:
Rebase for new release.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/python-xyz.scm (python-pyvex): Update to 9.2.112.
* gnu/packages/patches/python-pyvex-remove-angr-dependency.patch:
Remove patch (merged upstream and included in new release).
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
