Security and patch rollup for ESR18 from FPR68

[classilla]

Through c42e1b94017661c37980eaef912e3a1abf26a402
Ignoring policy, build system and test-only changes

Not relevant:
M1595470 (Windows)
M1597792 (not required)
M1598040 (not needed)
M1597963 (Windows)
M1560660 (no dark theme)
M1511604 (we don't use Skia)
M1550815 (Android)
M1583735 (Android)
M1513855 (unaffected)
M1599181 (Stylo)
M1597794 (Windows)
M1590984 (Linux)
M1596778 (Windows)
M1598337 (GTK)

Not taking:
M1221256 (can't justify this, unlikely to benefit any existing tools)
M1603313 (just don't care enough)
M1591880 (telemetry eww gross)

Deferred:
M1602843 (might be relevant, but needs lots of adaptation, and doesn't seem high acuity)

Candidates:
M1507180 https://hg.mozilla.org/releases/mozilla-esr68/rev/6e1e8bfee8a1
M1598605 https://hg.mozilla.org/releases/mozilla-esr68/rev/a0035a3876eb

[classilla]

Through 54676ee974335201c644074a12fa99df9a604a3c

Not relevant:
M1587534 (not in code)
M1603055 (no BigInt ... yet?)
M1605867 (Windows)
M1601905 (Windows)

[roytam1]

should the title be "Security and patch rollup for FPR18 from ESR68"?

[classilla]

Declining M1602843, it just doesn't seem like a good idea.

[roytam1]

what about M1607443? StoreElementHole exists in 45ESR.

[classilla]

http://tenfourfox.blogspot.com/2020/01/tenfourfox-not-vulnerable-to-cve-2019.html