Re: [yocto] mozjs 60.9 CVE issues fix.

[Gyorgy Sarvari <skandigraun@gmail.com>]

On 5/15/25 10:30, sateesh m wrote:
>
> Thank you for your response. But i am having some doubts If I want to
> get upstream patches for the Firefox  60.9 version how to get it.
>
60.x ESR series is long abandoned, there are no upstream patches for it.
What are you trying to do? If you are trying to make it up to date
against today's known threats, that's realistically not doable. EOL
Yocto releases/recipes in general are not suitable for this.
If you have a more narrow goal, knowing it could help with getting
targeted, more useful answer on this list.
>
> Thanks & Regards,
> Satish M
>
>
> On Thu, 15 May, 2025, 12:22 pm Gyorgy Sarvari, <skandigraun@gmail.com>
> wrote:
>
>     On 5/15/25 06:34, sateesh m via lists.yoctoproject.org
>     <http://lists.yoctoproject.org> wrote:
>     >
>     > Hi Team,
>     >
>     > I am currently working on CVE-related issues in the mozjs
>     library that
>     > need to be fixed for version 60.9. I am using the Dunfell
>     branch, but
>     > upon comparing it to the Gatesgarth branch, I noticed an additional
>     > patch is available. The patch
>     > |file://0014-fallback-to-2011-C++-standard.patch| has been removed,
>     > and |0014-remove-JS_VOLATIME_ARM.patch| has been added instead.
>     >
>     > Could you confirm whether these changes need to be applied to my
>     local
>     > build as well? Additionally, I would like to understand the
>     reason for
>     > removing the fallback-to-2011 patch. If we retain it, could it
>     lead to
>     > any issues?
>     >
>     The patch comments look fairly descriptive. These are not security
>     fixes, rather change gcc compatibility.
>
>     0014-fallback-to-2011-C++-standard.patch - it was introduced because
>     Dunfell supported building on distros that came with an old gcc that
>     couldn't compile without this patch. But later Yocto releases dropped
>     support for these old distros, so this patch wasn't necessary. If your
>     compiler supports c++14, then this patch is optional for you, and
>     can be
>     safely dropped. But you can also keep it.
>
>     0014-remove-JS_VOLATIME_ARM.patch - This patch removes a
>     workaround that
>     was added to fix an old gcc bug. If you are using old gcc, or very old
>     Arm HW (that doesn't support aligned access), you shouldn't use
>     this patch.
>     >
>     > I want to incorporate upstream patch changes related to the mozjs
>     > library. Since version 60.9 is a tar bundle and not a Git source,
>     > where can I find relevant solutions and reference links?
>     >
>     Mozilla primarily does development in their Mercurial repo, where you
>     can also see the commit history[1]. Incidentally they have just
>     announced hosting their code in their official Github repo also, where
>     you can also browse the history[2] if you are more comfortable
>     with that
>     - mostly check in the js folder history.
>
>     Of course, security-wise the best would be if you could migrate to
>     newer
>     versions. All of these are pretty old, and most probably having
>     lots of
>     issues that weren't found back when developers were still fixing them.
>     (Not only mozjs, but whole Dunfell)
>
>     [1]: https://hg-edge.mozilla.org/mozilla-central/
>     [2]: https://github.com/mozilla-firefox/firefox
>     >
>     > I have reviewed Bugzilla IDs, and they indicate that the issue has
>     > been fixed in example Firefox ESR78 and ESR128 and few mentioned <91
>     > (Is that mean below 91 all versions may effect changes). However,
>     > based on my understanding, adding those changes might result in
>     > dependency package version issues, such as requiring a more recent
>     > Python version (e.g., Python 3.10).
>     >
>     > I would appreciate any clarification on this matter.
>     >
>     > Thanks in advance.
>     >
>     > Best regards,
>     >
>     > Satish M
>     >
>     >
>     > -=-=-=-=-=-=-=-=-=-=-=-
>     > Links: You receive all messages sent to this group.
>     > View/Reply Online (#65341):
>     https://lists.yoctoproject.org/g/yocto/message/65341
>     > Mute This Topic: https://lists.yoctoproject.org/mt/113122170/6084445
>     > Group Owner: yocto+owner@lists.yoctoproject.org
>     <mailto:yocto%2Bowner@lists.yoctoproject.org>
>     > Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub
>     [skandigraun@gmail.com]
>     > -=-=-=-=-=-=-=-=-=-=-=-
>     >
>