CVS commit: pkgsrc/www/firefox128

["David H. Gutteridge" <gutteridge%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   gutteridge
Date:           Wed Apr  2 18:32:39 UTC 2025

Modified Files:
        pkgsrc/www/firefox128: Makefile distinfo

Log Message:
firefox128: update to 128.9.0

Mozilla Foundation Security Advisory 2025-22
Security Vulnerabilities fixed in Firefox ESR 128.9

Announced
    April 1, 2025
Impact
    high
Products
    Firefox ESR
Fixed in

        Firefox ESR 128.9

#CVE-2025-3028: Use-after-free triggered by XSLTProcessor

Reporter
    Ivan Fratric of Google Project Zero
Impact
    high

Description

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free.
References

    Bug 1941002

#CVE-2025-3029: URL Bar Spoofing via non-BMP Unicode characters

Reporter
    Renwa Hiwa
Impact
    moderate

Description

A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack.
References

    Bug 1952213

#CVE-2025-3030: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9

Reporter
    Sylvestre Ledru, Paul Bone and the Mozilla Fuzzing Team
Impact
    high

Description

Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort 
some of these could have been exploited to run arbitrary code.
References

    Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/www/firefox128/Makefile
cvs rdiff -u -r1.12 -r1.13 pkgsrc/www/firefox128/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox128/Makefile
diff -u pkgsrc/www/firefox128/Makefile:1.18 pkgsrc/www/firefox128/Makefile:1.19
--- pkgsrc/www/firefox128/Makefile:1.18 Sat Mar 29 10:27:32 2025
+++ pkgsrc/www/firefox128/Makefile      Wed Apr  2 18:32:39 2025
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.18 2025/03/29 10:27:32 bsiegert Exp $
+# $NetBSD: Makefile,v 1.19 2025/04/02 18:32:39 gutteridge Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            128.8
-MOZ_BRANCH_MINOR=      .1esr
+MOZ_BRANCH=            128.9
+MOZ_BRANCH_MINOR=      .0esr
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       ${DISTNAME:S/.source//:S/b/beta/:S/esr//:S/firefox-/firefox128-/}

Index: pkgsrc/www/firefox128/distinfo
diff -u pkgsrc/www/firefox128/distinfo:1.12 pkgsrc/www/firefox128/distinfo:1.13
--- pkgsrc/www/firefox128/distinfo:1.12 Sat Mar 29 10:27:32 2025
+++ pkgsrc/www/firefox128/distinfo      Wed Apr  2 18:32:39 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.12 2025/03/29 10:27:32 bsiegert Exp $
+$NetBSD: distinfo,v 1.13 2025/04/02 18:32:39 gutteridge Exp $
 
-BLAKE2s (firefox-128.8.1esr.source.tar.xz) = 2f1fd56a28e7e03bece18e3cab9eefcbe9e7932952b96ad050da952a66ee41d3
-SHA512 (firefox-128.8.1esr.source.tar.xz) = 040c4c6667d5020569075e25cad21d019a66165cc2e05ecd386db2c1db1243473c4a1a96ca4901d734da8c7aee4761574b284afb44aff85cef071da995619157
-Size (firefox-128.8.1esr.source.tar.xz) = 562110116 bytes
+BLAKE2s (firefox-128.9.0esr.source.tar.xz) = 658a1b8318e4a3ac9119feb3396b4a2dfbc314d2efc846db87036a1bcf873c18
+SHA512 (firefox-128.9.0esr.source.tar.xz) = c0c8ac8374291cc93279064c73c17786c6f4fba7505ebc2cbd7a4ce7c82710620abdae7be15f60c43f9d10c3614fc9fd31f094e787105d528031c6f0510f7339
+Size (firefox-128.9.0esr.source.tar.xz) = 562959584 bytes
 BLAKE2s (nodejs-output-128.0.tgz) = a55b907ebe308948b99b9150d2530204c8fe2a5fda5ac371dd1163a6db43bcbc
 SHA512 (nodejs-output-128.0.tgz) = fba59ec14c43556749cac7a9233278e8dcd7779d5ba530ede67009bf1887c5d72dd31e3f440164b646738b465d852b882522caf7ed9aa4f81f53e588bdd3adec
 Size (nodejs-output-128.0.tgz) = 227482 bytes