Re: [yocto] mozjs 60.9 CVE issues fix.

[Gyorgy Sarvari <skandigraun@gmail.com>]

On 5/15/25 06:34, sateesh m via lists.yoctoproject.org wrote:
>
> Hi Team,
>
> I am currently working on CVE-related issues in the mozjs library that
> need to be fixed for version 60.9. I am using the Dunfell branch, but
> upon comparing it to the Gatesgarth branch, I noticed an additional
> patch is available. The patch
> |file://0014-fallback-to-2011-C++-standard.patch| has been removed,
> and |0014-remove-JS_VOLATIME_ARM.patch| has been added instead.
>
> Could you confirm whether these changes need to be applied to my local
> build as well? Additionally, I would like to understand the reason for
> removing the fallback-to-2011 patch. If we retain it, could it lead to
> any issues?
>
The patch comments look fairly descriptive. These are not security
fixes, rather change gcc compatibility.

0014-fallback-to-2011-C++-standard.patch - it was introduced because
Dunfell supported building on distros that came with an old gcc that
couldn't compile without this patch. But later Yocto releases dropped
support for these old distros, so this patch wasn't necessary. If your
compiler supports c++14, then this patch is optional for you, and can be
safely dropped. But you can also keep it.

0014-remove-JS_VOLATIME_ARM.patch - This patch removes a workaround that
was added to fix an old gcc bug. If you are using old gcc, or very old
Arm HW (that doesn't support aligned access), you shouldn't use this patch.
>
> I want to incorporate upstream patch changes related to the mozjs
> library. Since version 60.9 is a tar bundle and not a Git source,
> where can I find relevant solutions and reference links?
>
Mozilla primarily does development in their Mercurial repo, where you
can also see the commit history[1]. Incidentally they have just
announced hosting their code in their official Github repo also, where
you can also browse the history[2] if you are more comfortable with that
- mostly check in the js folder history.

Of course, security-wise the best would be if you could migrate to newer
versions. All of these are pretty old, and most probably having lots of
issues that weren't found back when developers were still fixing them.
(Not only mozjs, but whole Dunfell)

[1]: https://hg-edge.mozilla.org/mozilla-central/
[2]: https://github.com/mozilla-firefox/firefox
>
> I have reviewed Bugzilla IDs, and they indicate that the issue has
> been fixed in example Firefox ESR78 and ESR128 and few mentioned <91
> (Is that mean below 91 all versions may effect changes). However,
> based on my understanding, adding those changes might result in
> dependency package version issues, such as requiring a more recent
> Python version (e.g., Python 3.10).
>
> I would appreciate any clarification on this matter.
>
> Thanks in advance.
>
> Best regards,
>
> Satish M
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#65341): https://lists.yoctoproject.org/g/yocto/message/65341
> Mute This Topic: https://lists.yoctoproject.org/mt/113122170/6084445
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [skandigraun@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>