Bug 14071 - Firefox and Thunderbird 31.1
Summary: Firefox and Thunderbird 31.1
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Florian Hubold
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-08 23:40 CEST by David Walser
Modified: 2014-10-15 18:02 CEST (History)
13 users (show)

See Also:
Source RPM: firefox, thunderbird
CVE:
Status comment:


Attachments

Description David Walser 2014-09-08 23:40:46 CEST
First of all, a note that we do not need to push this as an update.

For the *next* update (which will be 31.2), it'll be our first switch to the 31.x ESR branch for our stable releases.  The purpose of testing this update is to get any possibly issues ironed out, so that we can issue the 31.2 update in a timely manner.

Besides the security issues that will be fixed in Firefox and Thunderbird 31.2, this update will fix one other security issue in Enigmail (part of the Thunderbird package), CVE-2013-5369, for which OpenSuSE issued an update today (September 8):
http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html

from http://lwn.net/Vulnerabilities/610601/

Also, note that the rootcerts, nspr, and nss packages are already up to date as of our last update to FF/TB 24.8, so there are no further updates to test for those packages at this time.  There may or may not be when it's time to test 31.2.

So, primarily it's just firefox, firefox-l10n, thunderbird, and thunderbird-l10n right now.  However, the update to 31.x also required some dependencies to be updated: libpng, sqlite3, and libvpx.  So we'll need to test those updates as well.  Note that libpng and sqlite3 have only been updated to the minimum versions required to build FF/TB, rather than the latest versions, so they'll probably be updated again before 31.2.

Finally, this is only packaged for Mageia 4 at this time.  We may push it for Mageia 3 once we've done some initial testing on these packages.

The SRPMS are:
firefox-31.1.0-1.mga4.src.rpm
firefox-l10n-31.1.0-1.mga4.src.rpm
thunderbird-31.1.0-1.mga4.src.rpm
thunderbird-l10n-31.1.0-1.mga4.src.rpm
libpng-1.6.10-1.1.mga4.src.rpm
sqlite3-3.8.4.2-1.mga4.src.rpm
libvpx-1.3.0-1.mga4.src.rpm

Full package list:
firefox-31.1.0-1.mga4
firefox-devel-31.1.0-1.mga4
firefox-af-31.1.0-1.mga4
firefox-ar-31.1.0-1.mga4
firefox-as-31.1.0-1.mga4
firefox-ast-31.1.0-1.mga4
firefox-be-31.1.0-1.mga4
firefox-bg-31.1.0-1.mga4
firefox-bn_BD-31.1.0-1.mga4
firefox-bn_IN-31.1.0-1.mga4
firefox-br-31.1.0-1.mga4
firefox-bs-31.1.0-1.mga4
firefox-ca-31.1.0-1.mga4
firefox-cs-31.1.0-1.mga4
firefox-csb-31.1.0-1.mga4
firefox-cy-31.1.0-1.mga4
firefox-da-31.1.0-1.mga4
firefox-de-31.1.0-1.mga4
firefox-el-31.1.0-1.mga4
firefox-en_GB-31.1.0-1.mga4
firefox-en_ZA-31.1.0-1.mga4
firefox-eo-31.1.0-1.mga4
firefox-es_AR-31.1.0-1.mga4
firefox-es_CL-31.1.0-1.mga4
firefox-es_ES-31.1.0-1.mga4
firefox-es_MX-31.1.0-1.mga4
firefox-et-31.1.0-1.mga4
firefox-eu-31.1.0-1.mga4
firefox-fa-31.1.0-1.mga4
firefox-ff-31.1.0-1.mga4
firefox-fi-31.1.0-1.mga4
firefox-fr-31.1.0-1.mga4
firefox-fy-31.1.0-1.mga4
firefox-ga_IE-31.1.0-1.mga4
firefox-gd-31.1.0-1.mga4
firefox-gl-31.1.0-1.mga4
firefox-gu_IN-31.1.0-1.mga4
firefox-he-31.1.0-1.mga4
firefox-hi-31.1.0-1.mga4
firefox-hr-31.1.0-1.mga4
firefox-hu-31.1.0-1.mga4
firefox-hy-31.1.0-1.mga4
firefox-id-31.1.0-1.mga4
firefox-is-31.1.0-1.mga4
firefox-it-31.1.0-1.mga4
firefox-ja-31.1.0-1.mga4
firefox-kk-31.1.0-1.mga4
firefox-km-31.1.0-1.mga4
firefox-kn-31.1.0-1.mga4
firefox-ko-31.1.0-1.mga4
firefox-ku-31.1.0-1.mga4
firefox-lg-31.1.0-1.mga4
firefox-lij-31.1.0-1.mga4
firefox-lt-31.1.0-1.mga4
firefox-lv-31.1.0-1.mga4
firefox-mai-31.1.0-1.mga4
firefox-mk-31.1.0-1.mga4
firefox-ml-31.1.0-1.mga4
firefox-mr-31.1.0-1.mga4
firefox-nb_NO-31.1.0-1.mga4
firefox-nl-31.1.0-1.mga4
firefox-nn_NO-31.1.0-1.mga4
firefox-nso-31.1.0-1.mga4
firefox-or-31.1.0-1.mga4
firefox-pa_IN-31.1.0-1.mga4
firefox-pl-31.1.0-1.mga4
firefox-pt_BR-31.1.0-1.mga4
firefox-pt_PT-31.1.0-1.mga4
firefox-ro-31.1.0-1.mga4
firefox-ru-31.1.0-1.mga4
firefox-si-31.1.0-1.mga4
firefox-sk-31.1.0-1.mga4
firefox-sl-31.1.0-1.mga4
firefox-sq-31.1.0-1.mga4
firefox-sr-31.1.0-1.mga4
firefox-sv_SE-31.1.0-1.mga4
firefox-ta-31.1.0-1.mga4
firefox-ta_LK-31.1.0-1.mga4
firefox-te-31.1.0-1.mga4
firefox-th-31.1.0-1.mga4
firefox-tr-31.1.0-1.mga4
firefox-uk-31.1.0-1.mga4
firefox-vi-31.1.0-1.mga4
firefox-zh_CN-31.1.0-1.mga4
firefox-zh_TW-31.1.0-1.mga4
firefox-zu-31.1.0-1.mga4
thunderbird-31.1.0-1.mga4
thunderbird-enigmail-31.1.0-1.mga4
nsinstall-31.1.0-1.mga4
thunderbird-ar-31.1.0-1.mga4
thunderbird-ast-31.1.0-1.mga4
thunderbird-be-31.1.0-1.mga4
thunderbird-bg-31.1.0-1.mga4
thunderbird-bn_BD-31.1.0-1.mga4
thunderbird-br-31.1.0-1.mga4
thunderbird-ca-31.1.0-1.mga4
thunderbird-cs-31.1.0-1.mga4
thunderbird-da-31.1.0-1.mga4
thunderbird-de-31.1.0-1.mga4
thunderbird-el-31.1.0-1.mga4
thunderbird-en_GB-31.1.0-1.mga4
thunderbird-es_AR-31.1.0-1.mga4
thunderbird-es_ES-31.1.0-1.mga4
thunderbird-et-31.1.0-1.mga4
thunderbird-eu-31.1.0-1.mga4
thunderbird-fi-31.1.0-1.mga4
thunderbird-fr-31.1.0-1.mga4
thunderbird-fy-31.1.0-1.mga4
thunderbird-ga-31.1.0-1.mga4
thunderbird-gd-31.1.0-1.mga4
thunderbird-gl-31.1.0-1.mga4
thunderbird-he-31.1.0-1.mga4
thunderbird-hr-31.1.0-1.mga4
thunderbird-hu-31.1.0-1.mga4
thunderbird-hy-31.1.0-1.mga4
thunderbird-id-31.1.0-1.mga4
thunderbird-is-31.1.0-1.mga4
thunderbird-it-31.1.0-1.mga4
thunderbird-ja-31.1.0-1.mga4
thunderbird-ko-31.1.0-1.mga4
thunderbird-lt-31.1.0-1.mga4
thunderbird-nb_NO-31.1.0-1.mga4
thunderbird-nl-31.1.0-1.mga4
thunderbird-nn_NO-31.1.0-1.mga4
thunderbird-pa_IN-31.1.0-1.mga4
thunderbird-pl-31.1.0-1.mga4
thunderbird-pt_BR-31.1.0-1.mga4
thunderbird-pt_PT-31.1.0-1.mga4
thunderbird-ro-31.1.0-1.mga4
thunderbird-ru-31.1.0-1.mga4
thunderbird-si-31.1.0-1.mga4
thunderbird-sk-31.1.0-1.mga4
thunderbird-sl-31.1.0-1.mga4
thunderbird-sq-31.1.0-1.mga4
thunderbird-sv_SE-31.1.0-1.mga4
thunderbird-ta_LK-31.1.0-1.mga4
thunderbird-tr-31.1.0-1.mga4
thunderbird-uk-31.1.0-1.mga4
thunderbird-vi-31.1.0-1.mga4
thunderbird-zh_CN-31.1.0-1.mga4
libpng16_16-1.6.10-1.1.mga4
libpng-devel-1.6.10-1.1.mga4
sqlite3-tcl-3.8.4.2-1.mga4
sqlite3-tools-3.8.4.2-1.mga4
lemon-3.8.4.2-1.mga4
libsqlite3-devel-3.8.4.2-1.mga4
libsqlite3-static-devel-3.8.4.2-1.mga4
libsqlite3_0-3.8.4.2-1.mga4
libvpx1-1.3.0-1.mga4
libvpx-devel-1.3.0-1.mga4
libvpx-utils-1.3.0-1.mga4

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2014-09-08 23:41:13 CEST
Also, thanks to Florian Hubold for packaging this.

CC: (none) => doktor5000

Comment 2 Florian Hubold 2014-09-08 23:53:01 CEST
FWIW, I'm already using thunderbird 31.1.0 since a few days without issues. If you notice anything, please consolidate it and let me know.
Comment 3 Manuel Hiebel 2014-09-09 00:11:17 CEST
I didn't saw this mail before updating (yesterday ?), but:

it's only me or firefox-l10n provide old lang file from firefox 28 instead of the 31 one ?
Comment 4 Florian Hubold 2014-09-09 00:33:16 CEST
(In reply to Manuel Hiebel from comment #3)
> it's only me or firefox-l10n provide old lang file from firefox 28 instead
> of the 31 one ?

Good catch, this is (again) due to https://bugs.mageia.org/show_bug.cgi?id=2868
Uploaded the changed files again manually:

[doktor5000@Mageia4 firefox-l10n]$ mgarepo upload SOURCES/*.xpi
User doktor5000 uploaded file f8353da0494fc8c0f16c62d7ff06db1e287b1e5a: ach.xpi
User doktor5000 uploaded file 7f544e2cd0717b8419e8fec6fd290b0ada8ffae4: an.xpi
User doktor5000 uploaded file 9899a86dd006ee23d50808b26ec5438fe7484dc2: en-US.xpi
User doktor5000 uploaded file 72133ed7a70413335783b251b42a697340c6fcfc: es-AR.xpi
User doktor5000 uploaded file 3a1c4b19ad7e53080f42f57ff2f3dc81d7add4b3: hsb.xpi
User doktor5000 uploaded file 4d0f41c90a5d9ecc8889246e2e0e34abe289e15c: id.xpi
User doktor5000 uploaded file 7450ebdc7b5b9e6ccd5c63254086f95cddf4fe34: ku.xpi
User doktor5000 uploaded file 2fbdde0eb957f5cfd8b553527103993f53ade80a: ms.xpi
User doktor5000 uploaded file 185ca040d352f0f0c11b0d45deb81969af06a238: rm.xpi
User doktor5000 uploaded file 1e7b5d1673e8be1e276e9dcda65a5880fb149cfb: son.xpi
User doktor5000 uploaded file 4893638a747213e259319eb427697b99a6a7c6cc: xh.xpi

The others did not change, it seems ...

Just submitted firefox-l10n-31.1.0-2.mga4
Comment 5 Bill Wilkinson 2014-09-09 16:19:26 CEST
Just installed, but we'll need a lightning update as well.

CC: (none) => wrw105

Comment 6 Olivier Delaune 2014-09-09 21:17:53 CEST
Tested on Mageia 4 64-bits. Everything works as before up to now.

CC: (none) => olivier.delaune

Comment 7 Olivier Delaune 2014-09-09 21:18:15 CEST
I was speaking about firefox. I di not tested Thunderbird.
Comment 8 David Walser 2014-09-10 18:19:55 CEST
(In reply to Bill Wilkinson from comment #5)
> Just installed, but we'll need a lightning update as well.

Indeed, it needs to be updated to 3.3.

CC: (none) => mageia

Comment 9 Otto Leipälä 2014-09-11 14:20:36 CEST
(In reply to Bill Wilkinson from comment #5)
> Just installed, but we'll need a lightning update as well.

If you cannot wait install it from thunderbird addons.
https://addons.mozilla.org/en/thunderbird/addon/lightning/

CC: (none) => ozkyster

Comment 10 Samuel Verschelde 2014-09-12 09:26:42 CEST
Regarding firefox, don't forget to test with a new profile too, check that the first page is ok, etc.

CC: (none) => stormi

Comment 11 Florian Hubold 2014-09-12 20:33:02 CEST
(In reply to David Walser from comment #8)
> (In reply to Bill Wilkinson from comment #5)
> > Just installed, but we'll need a lightning update as well.
> 
> Indeed, it needs to be updated to 3.3.

Just sent thunderbird-lightning-3.3-1.mga4 to mga4 updates_testing, may take a few hours to make it through the buildsystem.
Comment 12 Bill Wilkinson 2014-09-13 03:32:29 CEST
Tested mga4-64 with the usual battery: 
TB: send/receive/move/delete over IMAP/SMTP, lightning add calendar change an entry, joined IRC and had a chat on #mageia-qa

ff:
acid3, sunspider, javatester, youtube, heavy usage of tabs under general surfing, all behaving normally.
Comment 13 Marja Van Waes 2014-09-14 19:19:14 CEST
Just for the record (I doubt anything can be done about it):

FF: there are some leftovers from old language packs (must have been included in some firefox-*-24.5.0 packages)

Sesotho sa lebowa Language Pack 24.5.0 and 
Tamil (Sri Lanka) Language Pack 24.5.0 

are disabled after updating all FF-* packages from 24.8.0-1 to 31.1.0-2, because they are no longer compatible

CC: (none) => marja11

Comment 14 David GEIGER 2014-09-15 08:59:33 CEST
Tested mga4_64,

Testing complete for the new firefox-31.1.0-1.mga4, for me it's Ok and nothing to report.
All seems to work properly.

firefox-31.1.0-1.mga4
firefox-fr-31.1.0-2.mga4

CC: (none) => geiger.david68210

Comment 15 David Walser 2014-09-16 04:53:23 CEST
Florian, since we have some successful testing here, would you mind also packaging these for Mageia 3?
Comment 16 Florian Hubold 2014-09-16 21:48:17 CEST
(In reply to David Walser from comment #15)
> Florian, since we have some successful testing here, would you mind also
> packaging these for Mageia 3?

No I don't mind, but not before next week when I'm on vacation.
Comment 17 David Remy 2014-09-18 22:05:53 CEST
Tested firefox-31.1.0-1 on mga4_64.

Everything seems to be working as expected. Browsed to a few different test sites like http://html5test.com and http://peacekeeper.futuremark.com as well as a list of sites I commonly use, all without any issues.

CC: (none) => dpremy

Comment 18 Pete Larson 2014-09-25 00:50:55 CEST
31.1.0-? was crashing in a few seconds on mga5a2_64 but 31.1.0-5 seems stable after browsing several sites for 30 minutes or more and opening several tabs from sync list.

CC: (none) => petel123123

Comment 19 David Walser 2014-09-25 01:06:10 CEST
Pete, this bug is only about the Mageia 4 build right now.  For Cauldron, IINM, Florian got it to build with gcc, which should have solved the crashing.
Comment 20 Florian Hubold 2014-09-25 08:36:55 CEST
(In reply to David Walser from comment #19)
> For Cauldron, IINM, Florian got it to build with gcc, which should have solved
> the crashing.

Exactly. That was tracked in https://bugs.mageia.org/show_bug.cgi?id=14062 and the current version in core/release is firefox-31.1.0-6.mga5


_note to self_: enable webRTC for mga4 build and backport 31.1.0 to mga3

Status: NEW => ASSIGNED
Assignee: qa-bugs => doktor5000

Comment 21 Florian Hubold 2014-09-25 12:09:01 CEST
@QA: FWIW, seems nobody noticed yet that the KDE integration has been disabled, as firefox doesn't build anymore with the patches enabled. This is still not fixed in cauldron, and the same applies for mga4 and mga3 ...

So currently you get the default GTK filepicker instead of the KDE one, and also no more plasma notifications (download progress and such).
Comment 22 David Walser 2014-09-25 14:52:25 CEST
(In reply to Florian Hubold from comment #20)
> (In reply to David Walser from comment #19)
> > For Cauldron, IINM, Florian got it to build with gcc, which should have solved
> > the crashing.
> 
> Exactly. That was tracked in https://bugs.mageia.org/show_bug.cgi?id=14062
> and the current version in core/release is firefox-31.1.0-6.mga5
> 
> 
> _note to self_: enable webRTC for mga4 build and backport 31.1.0 to mga3

I saw you mention it on IRC, but FF is now at 31.1.1 and TB is now at 31.1.2.  It's not the most critical thing, as there's no changes between FF 31.1.0 and FF 31.1.1 and between TB 31.1.1 and TB 31.1.2, but I think there were some bugfixes between TB 31.1.0 and TB 31.1.1.  Why were there no changes in the latest update?  Because the changes were only in the bundled nss, and we build against the system one.

BTW, before your next Mageia 3 and Mageia 4 builds would probably be a good time to update libpng and sqlite3 the rest of the way.
Comment 23 Florian Hubold 2014-09-25 17:41:23 CEST
First things first :)
As you suggested, pushed libpng and sqlite3:
libpng-1.6.12-1.1.mga4
sqlite3-3.8.6-1.mga4

In the meantime, I'll work on FF/TB 31.1 for mga3, and when sqlite3 and libpng are through, I'll push another build of FF 31.1 for mga4 which reenables the KDE integration.
Comment 24 Florian Hubold 2014-09-26 23:15:31 CEST
@qa: FWIW, I've added a short section in your updates procedure about firefox and the KDE integration which I've mentioned, so you know what I'm talking about :)
https://wiki.mageia.org/en/Updates_Firefox#KDE_integration_patches
Florian Hubold 2014-09-26 23:18:20 CEST

See Also: (none) => https://bugzilla.mozilla.org/show_bug.cgi?id=1056834

Comment 25 David Walser 2014-09-26 23:23:54 CEST
(In reply to Florian Hubold from comment #24)
> @qa: FWIW, I've added a short section in your updates procedure about
> firefox and the KDE integration which I've mentioned, so you know what I'm
> talking about :)
> https://wiki.mageia.org/en/Updates_Firefox#KDE_integration_patches

Haha, the top half of that page is totally invalid info now.  I guess I should rewrite it someday.
Comment 26 Oden Eriksson 2014-09-29 15:36:41 CEST
Instead of breaking the mga3 distro by pushing new sqlite3 and libpng you could instead make FF/TB build with its bundled copies.

sqlite3 3.8.6 in mga3 updates_testing is currently blocking https://bugs.mageia.org/show_bug.cgi?id=14177

CC: (none) => oe

Comment 27 David Walser 2014-09-29 15:39:03 CEST
(In reply to Oden Eriksson from comment #26)
> Instead of breaking the mga3 distro by pushing new sqlite3 and libpng you
> could instead make FF/TB build with its bundled copies.
> 
> sqlite3 3.8.6 in mga3 updates_testing is currently blocking
> https://bugs.mageia.org/show_bug.cgi?id=14177

We could, but that's not how we've done it before.  I know this is a bit of an annoyance right now because of the build conflicts, but other than that I don't know of a real strong reason to build it bundled.  Once the FF/TB 31.2 update is pushed, it shouldn't cause any issues.
Comment 28 Florian Hubold 2014-09-29 17:44:57 CEST
(In reply to Oden Eriksson from comment #26)
> Instead of breaking the mga3 distro by pushing new sqlite3 and libpng you
> could instead make FF/TB build with its bundled copies.

That's why I've asked David before if we really want such version upgrades, as IIRC we did use bundled versions in the past in some similar cases. E.g. for the switch to TB 10.x in mga1 we had to use bundled libpng and libxul ...
Comment 29 David Walser 2014-09-29 17:58:07 CEST
I don't know about libpng, but I do remember that we've upgraded sqlite3 in the past.
Comment 30 Florian Hubold 2014-10-02 16:47:59 CEST
Okay, I've pushed a fixed libpng16 to updates_testing for mga3, see http://svnweb.mageia.org/packages?view=revision&revision=733689

- For mga4, ff and tb 31.1 should be complete and have already been built.

- For mga3, I'just pushed firefox after new sqlite3 has been built, and need to see if anything else needs updating (libvpx ...). And then I'll do thunderbird for mga3.
Comment 31 David Walser 2014-10-02 17:36:47 CEST
Thanks Florian.

I noticed some other minor issues.  The libpng16 in mga3 still says "Name: libpng" in the SPEC, and the filename is still libpng.spec.  Those should both be renamed to libpng16.  Also, the Provides: png-devel should be removed.  Then, the Firefox spec should have BuildRequires: libpng16-devel >= 2:1.6 instead of libpng-devel.
Comment 32 David Walser 2014-10-02 17:38:28 CEST
Also, I just wanted to double-check and be sure that the enigmail updates for TB are commited to SVN, as well as the changes you were going to make for WebRTC (in both Mageia 3 and Mageia 4 SVN).  Basically, such that the 31.2 update won't require anything else other than updating to 31.2.

Thanks again for your work on this.
Comment 33 Florian Hubold 2014-10-02 17:47:59 CEST
webRTC - check :)
enigmail - check :)

For libpng, I'll have a look again. For name: libpng, isn't that renaming? Also, why remove png-devel as provide? I've already bumped the buildrequires in firefox to >= 1.6.10. Different name is not required there, but if you like that I'd propose pkgconfig(png16) >= 1.6
Comment 34 David Walser 2014-10-02 17:58:46 CEST
The idea is not to replace the current libpng, that's why it's called libpng16 in SVN.  Other packages shouldn't pull it in as a BR unless they explicitly request it.  As for how you write that BR, if you want to use pkgconfig (which is only technically correct if the package uses pkg-config to locate the lib), it would be pkgconfig(libpng16) I believe.
Comment 35 Augier 2014-10-02 19:38:13 CEST
Tested on Mageia4 X86_64.

Thunderbird and Firefox running for a few hours now (continuously) no bug detected till now.

I just noticed a slightly increase of memory and RAM consumption compared to FF24. Nothing important.

CC: (none) => christophe

Comment 36 Christiaan Welvaart 2014-10-13 03:41:08 CEST
FYI: With iceape I use the mga3 libpng 1.5.x. The libpng version in mozilla's configure.in appears to be the version of the bundled libpng, not really a requirement.

CC: (none) => cjw

Comment 37 Florian Hubold 2014-10-14 23:38:17 CEST
If all goes well, firefox-31.2.0-1.mga4 should be available soon on mirrors, including firefox-l10n-31.2.0-1.mga4. Feel free to test already, now we have to switch to 31 soon.

Will also push for mga3 once initial tests are OK.
Comment 38 Otto Leipälä 2014-10-15 06:31:56 CEST
I start to testing it and changed summary to 31.2.

Summary: Firefox and Thunderbird 31.1 => Firefox and Thunderbird 31.2

Comment 39 David Walser 2014-10-15 18:02:24 CEST
Thanks Christiaan.  We'll have to do that for Firefox as well, because this libpng16 thing is just not working.  Maybe some of the other BRs are built against libpng15 so they still want to pull that one in.

I'm closing this bug as its only purpose was preliminary 31.1 testing (which unfortunately we never got to for mga3).  I'll open a new bug for 31.2.

Status: ASSIGNED => RESOLVED
Resolution: (none) => OLD
Summary: Firefox and Thunderbird 31.2 => Firefox and Thunderbird 31.1


Note You need to log in before you can comment on or make changes to this bug.