Source Mage code commit list

[Vlad Glagolev <scm AT sourcemage.org>]

GIT changes to stable-0.61 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

 crypto/nss/DETAILS                                             |    5 
 crypto/nss/HISTORY                                             |    8 
 crypto/nss/PRE_BUILD                                           |    5 
 crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch |  407 
++++++++++
 database/sqlite/DETAILS                                        |    6 
 database/sqlite/HISTORY                                        |    9 
 http/firefox/BUILD                                             |    8 
 http/firefox/DETAILS                                           |    6 
 http/firefox/HISTORY                                           |   18 
 http/seamonkey/DEPENDS                                         |    4 
 http/seamonkey/DETAILS                                         |    6 
 http/seamonkey/HISTORY                                         |    6 
 mail/thunderbird/BUILD                                         |   14 
 mail/thunderbird/DETAILS                                       |    5 
 mail/thunderbird/HISTORY                                       |    8 
 15 files changed, 496 insertions(+), 19 deletions(-)

New commits:
commit 78efb7a4bf93ae882fb66b2b5edcc3b3f03cad9e
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    http/firefox: version 21.0
    (cherry picked from commit f0fcb0189ed039da11035cfa369fa343c81cc746)

commit a9c0fed97bed6a46b33deda81302062d7ddb4098
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    http/firefox: version 20.0.1
    (cherry picked from commit 8a0b49eceb3621d5f07de5364973a3f005f29f81)

commit 574ba748b58bcb2c3fe880a4ee9311332f3fbf2d
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    http/firefox: version 20.0
    (cherry picked from commit 432f4926f30a2f3b3188c3f0358b7fc46adf9cff)

commit d287b3369de4d71c3e2415e6aff4d6de4f59fa1d
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    http/firefox: disable avx for all gcc versions >= 4.6
    (cherry picked from commit 1170c465bcb4a264d1d2639d9f7440dcdee788e8)

commit 2cb37daf52387507e30bfbb2600eafc8e6005c0a
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    http/firefox: version 19.0.2, security update
    (cherry picked from commit 394b5e9ecea87bedc2acef6b5a517c43c0f11c7f)

commit a53bea4558f2b757337650e91771a59d191ca254
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    http/firefox: disable avx when using gcc 4.7
    (cherry picked from commit 4e76ebee07894c25f485f272c9d42237cdce9eee)

commit 40d48d7b8d2483844c8b2f0a5b11a8047e1b28d1
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    mail/thunderbird: version 17.0.5, security update
    (cherry picked from commit b3e24d42129fdba449aff876ae8aac392623abc6)

commit aa836c53896c9686d818c5981b5d00db19f9f99c
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    mail/thunderbird: version 17.0.4esr, security update
    (cherry picked from commit 0d18d550fd7adf40b9320c3b6da97ac125353a5e)

commit 9a55264d6cff053ead2a987bf907988c93a58d8c
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    seamonkey: updated required versions for nss and sqlite
    (cherry picked from commit 572a0084aa4e19f059f47b6d35167b6c10110b8f)

commit 7bc6e81d066f2dcb52723136aed1b5d9a4d398bd
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    fixup for 8ffe1be7f82f556c74b4d1fac110a68617d031ac
    (cherry picked from commit 04837d070a3fc226a485d7361bd9c30aa56b86dd)

commit 08f6ddca46e0acf95a075285b017dc7f3065c446
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    Revert "Revert "nss 3.14.2""
    
    This reverts commit 2d3c1bfd79057937f626a17435d200d237309a25.

commit f0d20fc8e29326058c99af1262941ae849ee6dbc
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    sqlite: => 3.7.15.2
    (cherry picked from commit b283c6705fd0f81fe21d819e4f0624a8c9294049)

commit 20ebaa4c0e0556ec628d74177049637c3e2e6b2c
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    sqlite: => 3.7.15.1
    (cherry picked from commit 51ccb9bdb08d5c922bf333d970a7eb5249e71144)

commit 2f75928bc46ee461662ccf7c44d7664cf9dc25b8
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    sqlite: => 3.7.15
    (cherry picked from commit 2649f4cef044d89e71228d592ea158bacbe63b95)

commit b553662476f0912e0473186e6315f063c38b0af3
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    crypto/nss: version 3.14.3
    (cherry picked from commit 57f48bc539ef40fca3731af8607f6b00961a08ff)

commit b5ee75ac2739ccbe4e76268adbef44061ca98a05
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    seamonkey 2.17.1, SECURITY_PATCH=53
    (cherry picked from commit a7dbebf17b84b9d7fc4c5d617f6e209c23ed38cc)

diff --git a/crypto/nss/DETAILS b/crypto/nss/DETAILS
index 346b2df..fba0f10 100755
--- a/crypto/nss/DETAILS
+++ b/crypto/nss/DETAILS
@@ -37,11 +37,10 @@ case $NSS_BRANCH in
       
SOURCE_HASH=sha512:45bc254eb238ea23fdd8d2c9128a22cebe15fda9ed5c9c1d112b5756d4d2b76e7f3a99d3600254bdcd6eeb18bda224d52e676e169207193798200f0d41baa29d
   ;;
   3.14)
-          VERSION=3.14.1
-       PATCHLEVEL=1
+          VERSION=3.14.3
            SOURCE=$SPELL-$VERSION.tar.gz
     
SOURCE_URL[0]=http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_${VERSION//./_}_RTM/src/$SOURCE
-      
SOURCE_HASH=sha512:f62a7ebcdade8815379f80929c63de1284c3ca3f5c87214cb5b327f6689635118d301969d4ef0e1940c7a426253b13ce54acd68a91abc23ab32626341217580e
+      
SOURCE_HASH=sha512:4e8d8517ffb6d03da274afe9a7c50e2f0a15ffdd83e63f29a445e7aee829a8b7e2fbc772695322bd6acee81c052811735b542978044996156cb52dd7e4c001ec
   ;;
 esac
 
diff --git a/crypto/nss/HISTORY b/crypto/nss/HISTORY
index c687b9e..04e5e6d 100644
--- a/crypto/nss/HISTORY
+++ b/crypto/nss/HISTORY
@@ -1,3 +1,8 @@
+2013-04-02 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 3.14.3
+       * nss-3.14.3_sync_with_upstream_softokn_changes.patch, PRE_BUILD:
+         apply patch from gentoo to fix compile error
+
 2013-02-19 Remko van der Vossen <wich AT sourcemage.org>
        * PRE_BUILD: fix patch apply if statement
 
@@ -7,6 +12,9 @@
          libssl.a -> libssl3.a (according to installed libssl3.so shared lib)
        * UP_TRIGGERS: added, for correct repairing sequence
 
+2013-02-05 Ladislav Hagara <hgr AT vabo.cz>
+       * DETAILS: 3.14.2
+
 2013-01-15 Vlad Glagolev <stealth AT sourcemage.org>
        * SUB_DEPENDS: corrected message about 3.14 branch
 
diff --git a/crypto/nss/PRE_BUILD b/crypto/nss/PRE_BUILD
index 9828554..e1c1e62 100755
--- a/crypto/nss/PRE_BUILD
+++ b/crypto/nss/PRE_BUILD
@@ -10,5 +10,8 @@ fi &&
 
 if [[ "$NSS_PEM" == "y" ]]; then
 tar jxvf $SCRIPT_DIRECTORY/nss-pem-20100412.tar.bz2 &&
-patch -p0 < $SCRIPT_DIRECTORY/nss-enable-pem.patch
+patch -p0 < $SCRIPT_DIRECTORY/nss-enable-pem.patch &&
+if [[ $NSS_BRANCH == "3.14" || $NSS_BRANCH == "DEFAULT" ]]; then
+  patch -p1 < 
$SPELL_DIRECTORY/nss-3.14.3_sync_with_upstream_softokn_changes.patch
+fi
 fi
diff --git a/crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch 
b/crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch
new file mode 100644
index 0000000..9611c13
--- /dev/null
+++ b/crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch
@@ -0,0 +1,407 @@
+From d6dbecfea317a468be12423595e584f43d84d8ec Mon Sep 17 00:00:00 2001
+From: Elio Maldonado <emaldona AT redhat.com>
+Date: Sat, 9 Feb 2013 17:11:00 -0500
+Subject: [PATCH] Sync up with upstream softokn changes
+
+- Disable RSA OEP case in FormatBlock, RSA_OAEP support is experimental and 
in a state of flux
+- Numerous change upstream due to the work for TLS/DTLS 'Lucky 13' 
vulnerability CVE-2013-0169
+- It now compiles with the NSS_3_14_3_BETA1 source
+---
+ mozilla/security/nss/lib/ckfw/pem/rsawrapr.c |  338 
+++++++-------------------
+ 1 files changed, 82 insertions(+), 256 deletions(-)
+
+diff --git a/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c 
b/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
+index 5ac4f39..3780d30 100644
+--- a/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
++++ b/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
+@@ -46,6 +46,7 @@
+ #include "sechash.h"
+ #include "base.h"
+ 
++#include "lowkeyi.h"
+ #include "secerr.h"
+ 
+ #define RSA_BLOCK_MIN_PAD_LEN         8
+@@ -54,9 +55,8 @@
+ #define RSA_BLOCK_PRIVATE_PAD_OCTET   0xff
+ #define RSA_BLOCK_AFTER_PAD_OCTET     0x00
+ 
+-#define OAEP_SALT_LEN         8
+-#define OAEP_PAD_LEN          8
+-#define OAEP_PAD_OCTET                0x00
++/* Needed for RSA-PSS functions */
++static const unsigned char eightZeros[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
+ 
+ #define FLAT_BUFSIZE 512        /* bytes to hold flattened SHA1Context. */
+ 
+@@ -78,127 +78,39 @@ pem_PublicModulusLen(NSSLOWKEYPublicKey *pubk)
+     return 0;
+ }
+ 
+-static SHA1Context *SHA1_CloneContext(SHA1Context * original)
+-{
+-    SHA1Context *clone = NULL;
+-    unsigned char *pBuf;
+-    int sha1ContextSize = SHA1_FlattenSize(original);
+-    SECStatus frv;
+-    unsigned char buf[FLAT_BUFSIZE];
+-
+-    PORT_Assert(sizeof buf >= sha1ContextSize);
+-    if (sizeof buf >= sha1ContextSize) {
+-        pBuf = buf;
+-    } else {
+-        pBuf = nss_ZAlloc(NULL, sha1ContextSize);
+-        if (!pBuf)
+-            goto done;
+-    }
+-
+-    frv = SHA1_Flatten(original, pBuf);
+-    if (frv == SECSuccess) {
+-        clone = SHA1_Resurrect(pBuf, NULL);
+-        memset(pBuf, 0, sha1ContextSize);
+-    }
+-  done:
+-    if (pBuf != buf)
+-        nss_ZFreeIf(pBuf);
+-    return clone;
++/* Constant time comparison of a single byte.
++ * Returns 1 iff a == b, otherwise returns 0.
++ * Note: For ranges of bytes, use constantTimeCompare.
++ */
++static unsigned char constantTimeEQ8(unsigned char a, unsigned char b) {
++    unsigned char c = ~(a - b | b - a);
++    c >>= 7;
++    return c;
+ }
+ 
+-/*
+- * Modify data by XORing it with a special hash of salt.
++/* Constant time comparison of a range of bytes.
++ * Returns 1 iff len bytes of a are identical to len bytes of b, otherwise
++ * returns 0.
+  */
+-static SECStatus
+-oaep_xor_with_h1(unsigned char *data, unsigned int datalen,
+-                 unsigned char *salt, unsigned int saltlen)
+-{
+-    SHA1Context *sha1cx;
+-    unsigned char *dp, *dataend;
+-    unsigned char end_octet;
+-
+-    sha1cx = SHA1_NewContext();
+-    if (sha1cx == NULL) {
+-        return SECFailure;
+-    }
+-
+-    /*
+-     * Get a hash of salt started; we will use it several times,
+-     * adding in a different end octet (x00, x01, x02, ...).
+-     */
+-    SHA1_Begin(sha1cx);
+-    SHA1_Update(sha1cx, salt, saltlen);
+-    end_octet = 0;
+-
+-    dp = data;
+-    dataend = data + datalen;
+-
+-    while (dp < dataend) {
+-        SHA1Context *sha1cx_h1;
+-        unsigned int sha1len, sha1off;
+-        unsigned char sha1[SHA1_LENGTH];
+-
+-        /*
+-         * Create hash of (salt || end_octet)
+-         */
+-        sha1cx_h1 = SHA1_CloneContext(sha1cx);
+-        SHA1_Update(sha1cx_h1, &end_octet, 1);
+-        SHA1_End(sha1cx_h1, sha1, &sha1len, sizeof(sha1));
+-        SHA1_DestroyContext(sha1cx_h1, PR_TRUE);
+-        PORT_Assert(sha1len == SHA1_LENGTH);
+-
+-        /*
+-         * XOR that hash with the data.
+-         * When we have fewer than SHA1_LENGTH octets of data
+-         * left to xor, use just the low-order ones of the hash.
+-         */
+-        sha1off = 0;
+-        if ((dataend - dp) < SHA1_LENGTH)
+-            sha1off = SHA1_LENGTH - (dataend - dp);
+-        while (sha1off < SHA1_LENGTH)
+-            *dp++ ^= sha1[sha1off++];
+-
+-        /*
+-         * Bump for next hash chunk.
+-         */
+-        end_octet++;
+-    }
+-
+-    SHA1_DestroyContext(sha1cx, PR_TRUE);
+-    return SECSuccess;
++static unsigned char constantTimeCompare(const unsigned char *a,
++                                         const unsigned char *b,
++                                         unsigned int len) {
++    unsigned char tmp = 0;
++    unsigned int i;
++    for (i = 0; i < len; ++i, ++a, ++b)
++        tmp |= *a ^ *b;
++    return constantTimeEQ8(0x00, tmp);
+ }
+ 
+-/*
+- * Modify salt by XORing it with a special hash of data.
++/* Constant time conditional.
++ * Returns a if c is 1, or b if c is 0. The result is undefined if c is
++ * not 0 or 1.
+  */
+-static SECStatus
+-oaep_xor_with_h2(unsigned char *salt, unsigned int saltlen,
+-                 unsigned char *data, unsigned int datalen)
++static unsigned int constantTimeCondition(unsigned int c,
++                                          unsigned int a,
++                                          unsigned int b)
+ {
+-    unsigned char sha1[SHA1_LENGTH];
+-    unsigned char *psalt, *psha1, *saltend;
+-    SECStatus rv;
+-
+-    /*
+-     * Create a hash of data.
+-     */
+-    rv = SHA1_HashBuf(sha1, data, datalen);
+-    if (rv != SECSuccess) {
+-        return rv;
+-    }
+-
+-    /*
+-     * XOR the low-order octets of that hash with salt.
+-     */
+-    PORT_Assert(saltlen <= SHA1_LENGTH);
+-    saltend = salt + saltlen;
+-    psalt = salt;
+-    psha1 = sha1 + SHA1_LENGTH - saltlen;
+-    while (psalt < saltend) {
+-        *psalt++ ^= *psha1++;
+-    }
+-
+-    return SECSuccess;
++    return (~(c - 1) & a) | ((c - 1) & b);
+ }
+ 
+ /*
+@@ -212,7 +124,7 @@ static unsigned char *rsa_FormatOneBlock(unsigned 
modulusLen,
+     unsigned char *block;
+     unsigned char *bp;
+     int padLen;
+-    int i;
++    int i, j;
+     SECStatus rv;
+ 
+     block = (unsigned char *) nss_ZAlloc(NULL, modulusLen);
+@@ -260,124 +172,58 @@ static unsigned char *rsa_FormatOneBlock(unsigned 
modulusLen,
+          */
+     case RSA_BlockPublic:
+ 
+-        /*
+-         * 0x00 || BT || Pad || 0x00 || ActualData
+-         *   1      1   padLen    1      data->len
+-         * Pad is all non-zero random bytes.
+-         */
+-        padLen = modulusLen - data->len - 3;
+-        PORT_Assert(padLen >= RSA_BLOCK_MIN_PAD_LEN);
+-        if (padLen < RSA_BLOCK_MIN_PAD_LEN) {
+-            nss_ZFreeIf(block);
+-            return NULL;
+-        }
+-        for (i = 0; i < padLen; i++) {
+-            /* Pad with non-zero random data. */
+-            do {
+-                rv = RNG_GenerateGlobalRandomBytes(bp + i, 1);
+-            } while (rv == SECSuccess
+-                     && bp[i] == RSA_BLOCK_AFTER_PAD_OCTET);
+-            if (rv != SECSuccess) {
+-                nss_ZFreeIf(block);
+-                return NULL;
+-            }
+-        }
+-        bp += padLen;
+-        *bp++ = RSA_BLOCK_AFTER_PAD_OCTET;
+-        nsslibc_memcpy(bp, data->data, data->len);
+-
+-        break;
+-
+-        /*
+-         * Blocks intended for public-key operation, using
+-         * Optimal Asymmetric Encryption Padding (OAEP).
+-         */
+-    case RSA_BlockOAEP:
+-        /*
+-         * 0x00 || BT || Modified2(Salt) || Modified1(PaddedData)
+-         *   1      1     OAEP_SALT_LEN     OAEP_PAD_LEN + data->len [+ N]
+-         *
+-         * where:
+-         *   PaddedData is "Pad1 || ActualData [|| Pad2]"
+-         *   Salt is random data.
+-         *   Pad1 is all zeros.
+-         *   Pad2, if present, is random data.
+-         *   (The "modified" fields are all the same length as the original
+-         * unmodified values; they are just xor'd with other values.)
+-         *
+-         *   Modified1 is an XOR of PaddedData with a special octet
+-         * string constructed of iterated hashing of Salt (see below).
+-         *   Modified2 is an XOR of Salt with the low-order octets of
+-         * the hash of Modified1 (see farther below ;-).
+-         *
+-         * Whew!
+-         */
+-
+-
+-        /*
+-         * Salt
+-         */
+-        rv = RNG_GenerateGlobalRandomBytes(bp, OAEP_SALT_LEN);
+-        if (rv != SECSuccess) {
+-            nss_ZFreeIf(block);
+-            return NULL;
+-        }
+-        bp += OAEP_SALT_LEN;
+-
+-        /*
+-         * Pad1
+-         */
+-        nsslibc_memset(bp, OAEP_PAD_OCTET, OAEP_PAD_LEN);
+-        bp += OAEP_PAD_LEN;
+-
+-        /*
+-         * Data
+-         */
+-        nsslibc_memcpy(bp, data->data, data->len);
+-        bp += data->len;
+-
+-        /*
+-         * Pad2
+-         */
+-        if (bp < (block + modulusLen)) {
+-            rv = RNG_GenerateGlobalRandomBytes(bp,
+-                                               block - bp + modulusLen);
+-            if (rv != SECSuccess) {
+-                nss_ZFreeIf(block);
+-                return NULL;
+-            }
+-        }
+-
+-        /*
+-         * Now we have the following:
+-         * 0x00 || BT || Salt || PaddedData
+-         * (From this point on, "Pad1 || Data [|| Pad2]" is treated
+-         * as the one entity PaddedData.)
+-         *
+-         * We need to turn PaddedData into Modified1.
+-         */
+-        if (oaep_xor_with_h1(block + 2 + OAEP_SALT_LEN,
+-                             modulusLen - 2 - OAEP_SALT_LEN,
+-                             block + 2, OAEP_SALT_LEN) != SECSuccess) {
+-            nss_ZFreeIf(block);
+-            return NULL;
+-        }
+-
+-        /*
+-         * Now we have:
+-         * 0x00 || BT || Salt || Modified1(PaddedData)
+-         *
+-         * The remaining task is to turn Salt into Modified2.
+-         */
+-        if (oaep_xor_with_h2(block + 2, OAEP_SALT_LEN,
+-                             block + 2 + OAEP_SALT_LEN,
+-                             modulusLen - 2 - OAEP_SALT_LEN) !=
+-            SECSuccess) {
+-            nss_ZFreeIf(block);
+-            return NULL;
+-        }
+-
+-        break;
++      /*
++       * 0x00 || BT || Pad || 0x00 || ActualData
++       *   1      1   padLen    1      data->len
++       * Pad is all non-zero random bytes.
++       *
++       * Build the block left to right.
++       * Fill the entire block from Pad to the end with random bytes.
++       * Use the bytes after Pad as a supply of extra random bytes from 
++       * which to find replacements for the zero bytes in Pad.
++       * If we need more than that, refill the bytes after Pad with 
++       * new random bytes as necessary.
++       */
++      padLen = modulusLen - (data->len + 3);
++      PORT_Assert (padLen >= RSA_BLOCK_MIN_PAD_LEN);
++      if (padLen < RSA_BLOCK_MIN_PAD_LEN) {
++          nss_ZFreeIf (block);
++          return NULL;
++      }
++      j = modulusLen - 2;
++      rv = RNG_GenerateGlobalRandomBytes(bp, j);
++      if (rv == SECSuccess) {
++          for (i = 0; i < padLen; ) {
++              unsigned char repl;
++              /* Pad with non-zero random data. */
++              if (bp[i] != RSA_BLOCK_AFTER_PAD_OCTET) {
++                  ++i;
++                  continue;
++              }
++              if (j <= padLen) {
++                  rv = RNG_GenerateGlobalRandomBytes(bp + padLen,
++                                        modulusLen - (2 + padLen));
++                  if (rv != SECSuccess)
++                      break;
++                  j = modulusLen - 2;
++              }
++              do {
++                  repl = bp[--j];
++              } while (repl == RSA_BLOCK_AFTER_PAD_OCTET && j > padLen);
++              if (repl != RSA_BLOCK_AFTER_PAD_OCTET) {
++                  bp[i++] = repl;
++              }
++          }
++      }
++      if (rv != SECSuccess) {
++          /*sftk_fatalError = PR_TRUE;*/
++          nss_ZFreeIf (block);
++          return NULL;
++      }
++      bp += padLen;
++      *bp++ = RSA_BLOCK_AFTER_PAD_OCTET;
++      nsslibc_memcpy(bp, data->data, data->len);
++      break;
+ 
+     default:
+         PORT_Assert(0);
+@@ -427,26 +273,6 @@ rsa_FormatBlock(SECItem * result, unsigned modulusLen,
+ 
+         break;
+ 
+-    case RSA_BlockOAEP:
+-        /*
+-         * 0x00 || BT || M1(Salt) || M2(Pad1||ActualData[||Pad2])
+-         *
+-         * The "2" below is the first octet + the second octet.
+-         * (The other fields do not contain the clear values, but are
+-         * the same length as the clear values.)
+-         */
+-        PORT_Assert(data->len <= (modulusLen - (2 + OAEP_SALT_LEN
+-                                                + OAEP_PAD_LEN)));
+-
+-        result->data = rsa_FormatOneBlock(modulusLen, blockType, data);
+-        if (result->data == NULL) {
+-            result->len = 0;
+-            return SECFailure;
+-        }
+-        result->len = modulusLen;
+-
+-        break;
+-
+     case RSA_BlockRaw:
+         /*
+          * Pad || ActualData
+-- 
+1.7.1
+
+
diff --git a/database/sqlite/DETAILS b/database/sqlite/DETAILS
index 7c0819f..233200b 100755
--- a/database/sqlite/DETAILS
+++ b/database/sqlite/DETAILS
@@ -1,7 +1,7 @@
            SPELL=sqlite
-         VERSION=3.7.14.1
-        VERSIONX=autoconf-3071401
-     
SOURCE_HASH=sha512:0d66e32e5d5d6d83f106f1dea66d08c96846a4c74d4a536be7eeb9f30823988fbc3ecb7377fcddc5c2fa06ad94dd0a27f7f6ef4665718354eb92edc8431631c9
+         VERSION=3.7.15.2
+        VERSIONX=autoconf-3071502
+     
SOURCE_HASH=sha512:ccec842f649c1dd47aed4712fc775d41097daca895ccc8b7fee24771f6c1832fb5210473f62dc62d4391c0a47ed3dfc9b92046fa7937aeb859105680942da082
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/${SPELL}-${VERSIONX}"
           SOURCE=${SPELL}-${VERSIONX}.tar.gz
    SOURCE_URL[0]=http://sqlite.org/$SOURCE
diff --git a/database/sqlite/HISTORY b/database/sqlite/HISTORY
index 5a9791f..9ec3438 100644
--- a/database/sqlite/HISTORY
+++ b/database/sqlite/HISTORY
@@ -1,3 +1,12 @@
+2013-01-10 Vlad Glagolev <stealth AT sourcemage.org>
+       * DETAILS: updated spell to 3.7.15.2
+
+2012-12-22 Vlad Glagolev <stealth AT sourcemage.org>
+       * DETAILS: updated spell to 3.7.15.1
+
+2012-12-13 Vlad Glagolev <stealth AT sourcemage.org>
+       * DETAILS: updated spell to 3.7.15
+
 2012-10-05 Vlad Glagolev <stealth AT sourcemage.org>
        * DETAILS: updated spell to 3.7.14.1
 
diff --git a/http/firefox/BUILD b/http/firefox/BUILD
index 1f2ae04..6e7d374 100755
--- a/http/firefox/BUILD
+++ b/http/firefox/BUILD
@@ -20,8 +20,12 @@ CXXFLAGS="${CXXFLAGS//-ffast-math/}"  &&
 #
 # Avoid buggy GCC 4.6 AVX code generation, which breaks libxul
 #
-local gccver=$(gcc -dumpversion)
-if [ ${gccver%.*} = 4.6 ]; then
+local gccver=$(gcc -dumpversion) &&
+local gccmajor=${gccver%.*.*}    &&
+local gccminor=${gccver#*.}      &&
+gccminor=${gccminor%.*}          &&
+
+if [[ $gccmajor == "4" ]] && [[ $gccminor -ge "6" ]]; then
   CFLAGS="${CFLAGS//-mavx} -mno-avx"
   CXXFLAGS="${CXXFLAGS//-mavx} -mno-avx"
 fi
diff --git a/http/firefox/DETAILS b/http/firefox/DETAILS
index 3b024dd..8180b53 100755
--- a/http/firefox/DETAILS
+++ b/http/firefox/DETAILS
@@ -1,13 +1,13 @@
            SPELL=firefox
 if [[ $FIREFOX_CVS == y ]]; then
-         VERSION=19.0
+         VERSION=21.0
           SOURCE=$SPELL-$VERSION.source.tar.bz2
          SOURCE2=$SOURCE.asc
       SOURCE_GPG=firefox.gpg:$SOURCE2:UPSTREAM_KEY
    
SOURCE_URL[0]=http://releases.mozilla.org/pub/mozilla.org/${SPELL}/releases/${VERSION}/source/${SOURCE}
   SOURCE2_URL[0]=$SOURCE_URL.asc
 else
-         VERSION=19.0
+         VERSION=21.0
           SOURCE=$SPELL-$VERSION.source.tar.bz2
          SOURCE2=$SOURCE.asc
       SOURCE_GPG=firefox.gpg:$SOURCE2:UPSTREAM_KEY
@@ -15,7 +15,7 @@ else
    
SOURCE_URL[1]=ftp://ftp.mozilla.org/pub/$SPELL/releases/$VERSION/source/$SOURCE
    
SOURCE_URL[2]=ftp://ftp.in2p3.fr/pub/mozilla/$SPELL/releases/$VERSION/source/$SOURCE
   SOURCE2_URL[0]=$SOURCE_URL.asc
-  SECURITY_PATCH=61
+  SECURITY_PATCH=64
 fi
   SOURCE2_IGNORE=signature
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/http/firefox/HISTORY b/http/firefox/HISTORY
index 63341d1..39d8663 100644
--- a/http/firefox/HISTORY
+++ b/http/firefox/HISTORY
@@ -1,3 +1,21 @@
+2013-04-12 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 21.0, SECURITY_PATCH++
+
+2013-04-12 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 20.0.1, SECURITY_PATCH++
+
+2013-04-02 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 20.0, SECURITY_PATCH++
+
+2013-03-22 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * BUILD: disable avx support for all versions of gcc >= 4.6
+
+2013-03-08 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 19.0.2, SECURITY_PATCH++
+
+2013-02-23 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * BUILD: disable avx support when using gcc 4.7
+
 2013-02-20 Ladislav Hagara <hgr AT vabo.cz>
        * DETAILS: 19.0, SECURITY_PATCH=61
 
diff --git a/http/seamonkey/DEPENDS b/http/seamonkey/DEPENDS
index ddbdd73..f6c8e91 100755
--- a/http/seamonkey/DEPENDS
+++ b/http/seamonkey/DEPENDS
@@ -13,13 +13,13 @@ fi &&
 
 depends -sub 3.14.x nss &&
 
-if spell_ok nss && is_version_less $(installed_version nss) 3.14.1; then
+if spell_ok nss && is_version_less $(installed_version nss) 3.14.3; then
   force_depends nss
 fi &&
 
 depends -sub "TSAFE SECURE_DELETE ENABLE_UNLOCK_NOTIFY" sqlite &&
 
-if spell_ok sqlite && is_version_less $(installed_version sqlite) 3.7.14.1; 
then
+if spell_ok sqlite && is_version_less $(installed_version sqlite) 3.7.15.2; 
then
   force_depends sqlite
 fi &&
 
diff --git a/http/seamonkey/DETAILS b/http/seamonkey/DETAILS
index 71b77d6..3f0515e 100755
--- a/http/seamonkey/DETAILS
+++ b/http/seamonkey/DETAILS
@@ -1,8 +1,8 @@
            SPELL=seamonkey
-         VERSION=2.16
-  SECURITY_PATCH=52
+         VERSION=2.17.1
+  SECURITY_PATCH=53
           SOURCE=$SPELL-$VERSION.source.tar.bz2
-     
SOURCE_HASH=sha512:28b155d584cbbdfc83ebae9722586156c6dc2023ca8e337d24363d93189dc1254a9350e8ea68ad7c3c31a3ac50883f86adfb2747c2d27d907dee0dc47c2da761
+     
SOURCE_HASH=sha512:59a0fa0760247e936e74194d7508bb6553c45ea6108e5a21c193833d91c9fb5de2106ce477273f92ffc24d777744fc238dec8e625f33f1ef5b5112f4a895bcd3
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
       SOURCE_URI=seamonkey/releases/$VERSION/source/$SOURCE
    SOURCE_URL[0]=ftp://ftp.mozilla.org/pub/mozilla.org/$SOURCE_URI
diff --git a/http/seamonkey/HISTORY b/http/seamonkey/HISTORY
index e54b786..aae73ac 100644
--- a/http/seamonkey/HISTORY
+++ b/http/seamonkey/HISTORY
@@ -1,3 +1,9 @@
+2013-05-23 Vlad Glagolev <stealth AT sourcemage.org>
+       * DEPENDS: updated required versions for nss and sqlite
+
+2013-04-15 Ladislav Hagara <hgr AT vabo.cz>
+       * DETAILS: 2.17.1, SECURITY_PATCH=53
+
 2013-02-21 Ladislav Hagara <hgr AT vabo.cz>
        * DETAILS: 2.16, SECURITY_PATCH=52
 
diff --git a/mail/thunderbird/BUILD b/mail/thunderbird/BUILD
index 0f266cd..1f7ac66 100755
--- a/mail/thunderbird/BUILD
+++ b/mail/thunderbird/BUILD
@@ -31,6 +31,20 @@ if [[ $THUNDERBIRD_OFFICIAL == y ]]; then
   OPTS="$OPTS --enable-official-branding"
 fi
 
+#
+# Avoid buggy GCC 4.6 AVX code generation, which breaks libxul
+#
+local gccver=$(gcc -dumpversion) &&
+local gccmajor=${gccver%.*.*}    &&
+local gccminor=${gccver#*.}      &&
+gccminor=${gccminor%.*}          &&
+
+if [[ $gccmajor == "4" ]] && [[ $gccminor -ge "6" ]]; then
+  CFLAGS="${CFLAGS//-mavx} -mno-avx"
+  CXXFLAGS="${CXXFLAGS//-mavx} -mno-avx"
+fi
+
+
 ./configure --prefix=${INSTALL_ROOT}/usr     \
             --with-user-appdir=.thunderbird  \
             --enable-application=mail        \
diff --git a/mail/thunderbird/DETAILS b/mail/thunderbird/DETAILS
index bb41415..a1d6e35 100755
--- a/mail/thunderbird/DETAILS
+++ b/mail/thunderbird/DETAILS
@@ -1,13 +1,14 @@
            SPELL=thunderbird
-         VERSION=17.0.3
+         VERSION=17.0.5
           SOURCE=$SPELL-$VERSION.source.tar.bz2
          SOURCE2=$SOURCE.asc
       SOURCE_GPG="thunderbird.gpg:$SOURCE2:UPSTREAM_KEY"
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
+           TMPFS=off
    
SOURCE_URL[0]=http://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/$VERSION/source/$SOURCE
   
SOURCE2_URL[0]=http://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/$VERSION/source/$SOURCE2
   SOURCE2_IGNORE=signature
-  SECURITY_PATCH=34
+  SECURITY_PATCH=36
         WEB_SITE=http://www.mozilla.org/products/thunderbird/
          ENTERED=20041028
       LICENSE[0]=MOZILLA
diff --git a/mail/thunderbird/HISTORY b/mail/thunderbird/HISTORY
index ce1b31c..acebc2a 100644
--- a/mail/thunderbird/HISTORY
+++ b/mail/thunderbird/HISTORY
@@ -1,3 +1,11 @@
+2013-04-08 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 17.0.5, SECURITY_PATCH++
+       * BUILD: disable avx which causes a segfault
+
+2013-03-08 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+       * DETAILS: version 17.0.4esr, SECURITY_PATCH++,
+         TMPFS=off
+
 2013-02-22 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
        * DETAILS: version 17.0.3, SECURITY_PATCH++