mozjs 60.9 CVE issues fix.

mozjs 60.9 CVE issues fix.

[sateesh m]

[-- Attachment #1: Type: text/plain, Size: 1276 bytes --]

Hi Team,

I am currently working on CVE-related issues in the mozjs library that need to be fixed for version 60.9. I am using the Dunfell branch, but upon comparing it to the Gatesgarth branch, I noticed an additional patch is available. The patch file://0014-fallback-to-2011-C++-standard.patch has been removed, and 0014-remove-JS_VOLATIME_ARM.patch has been added instead.

Could you confirm whether these changes need to be applied to my local build as well? Additionally, I would like to understand the reason for removing the fallback-to-2011 patch. If we retain it, could it lead to any issues?

I want to incorporate upstream patch changes related to the mozjs library. Since version 60.9 is a tar bundle and not a Git source, where can I find relevant solutions and reference links? I have reviewed Bugzilla IDs, and they indicate that the issue has been fixed in example Firefox ESR78 and ESR128 and few mentioned <91 (Is that mean below 91 all versions may effect changes). However, based on my understanding, adding those changes might result in dependency package version issues, such as requiring a more recent Python version (e.g., Python 3.10).

I would appreciate any clarification on this matter.

Thanks in advance.

Best regards,

Satish M

[-- Attachment #2: Type: text/html, Size: 1467 bytes --]

Re: [yocto] mozjs 60.9 CVE issues fix.

[Gyorgy Sarvari]

On 5/15/25 06:34, sateesh m via lists.yoctoproject.org wrote:
>
> Hi Team,
>
> I am currently working on CVE-related issues in the mozjs library that
> need to be fixed for version 60.9. I am using the Dunfell branch, but
> upon comparing it to the Gatesgarth branch, I noticed an additional
> patch is available. The patch
> |file://0014-fallback-to-2011-C++-standard.patch| has been removed,
> and |0014-remove-JS_VOLATIME_ARM.patch| has been added instead.
>
> Could you confirm whether these changes need to be applied to my local
> build as well? Additionally, I would like to understand the reason for
> removing the fallback-to-2011 patch. If we retain it, could it lead to
> any issues?
>
The patch comments look fairly descriptive. These are not security
fixes, rather change gcc compatibility.

0014-fallback-to-2011-C++-standard.patch - it was introduced because
Dunfell supported building on distros that came with an old gcc that
couldn't compile without this patch. But later Yocto releases dropped
support for these old distros, so this patch wasn't necessary. If your
compiler supports c++14, then this patch is optional for you, and can be
safely dropped. But you can also keep it.

0014-remove-JS_VOLATIME_ARM.patch - This patch removes a workaround that
was added to fix an old gcc bug. If you are using old gcc, or very old
Arm HW (that doesn't support aligned access), you shouldn't use this patch.
>
> I want to incorporate upstream patch changes related to the mozjs
> library. Since version 60.9 is a tar bundle and not a Git source,
> where can I find relevant solutions and reference links?
>
Mozilla primarily does development in their Mercurial repo, where you
can also see the commit history[1]. Incidentally they have just
announced hosting their code in their official Github repo also, where
you can also browse the history[2] if you are more comfortable with that
- mostly check in the js folder history.

Of course, security-wise the best would be if you could migrate to newer
versions. All of these are pretty old, and most probably having lots of
issues that weren't found back when developers were still fixing them.
(Not only mozjs, but whole Dunfell)

[1]: https://hg-edge.mozilla.org/mozilla-central/
[2]: https://github.com/mozilla-firefox/firefox
>
> I have reviewed Bugzilla IDs, and they indicate that the issue has
> been fixed in example Firefox ESR78 and ESR128 and few mentioned <91
> (Is that mean below 91 all versions may effect changes). However,
> based on my understanding, adding those changes might result in
> dependency package version issues, such as requiring a more recent
> Python version (e.g., Python 3.10).
>
> I would appreciate any clarification on this matter.
>
> Thanks in advance.
>
> Best regards,
>
> Satish M
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#65341): https://lists.yoctoproject.org/g/yocto/message/65341
> Mute This Topic: https://lists.yoctoproject.org/mt/113122170/6084445
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [skandigraun@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

Re: [yocto] mozjs 60.9 CVE issues fix.

[sateesh m]

[-- Attachment #1: Type: text/plain, Size: 3664 bytes --]

Thank you for your response. But i am having some doubts If I want to get
upstream patches for the Firefox  60.9 version how to get it.

Thanks & Regards,
Satish M

On Thu, 15 May, 2025, 12:22 pm Gyorgy Sarvari, <skandigraun@gmail.com>
wrote:

> On 5/15/25 06:34, sateesh m via lists.yoctoproject.org wrote:
> >
> > Hi Team,
> >
> > I am currently working on CVE-related issues in the mozjs library that
> > need to be fixed for version 60.9. I am using the Dunfell branch, but
> > upon comparing it to the Gatesgarth branch, I noticed an additional
> > patch is available. The patch
> > |file://0014-fallback-to-2011-C++-standard.patch| has been removed,
> > and |0014-remove-JS_VOLATIME_ARM.patch| has been added instead.
> >
> > Could you confirm whether these changes need to be applied to my local
> > build as well? Additionally, I would like to understand the reason for
> > removing the fallback-to-2011 patch. If we retain it, could it lead to
> > any issues?
> >
> The patch comments look fairly descriptive. These are not security
> fixes, rather change gcc compatibility.
>
> 0014-fallback-to-2011-C++-standard.patch - it was introduced because
> Dunfell supported building on distros that came with an old gcc that
> couldn't compile without this patch. But later Yocto releases dropped
> support for these old distros, so this patch wasn't necessary. If your
> compiler supports c++14, then this patch is optional for you, and can be
> safely dropped. But you can also keep it.
>
> 0014-remove-JS_VOLATIME_ARM.patch - This patch removes a workaround that
> was added to fix an old gcc bug. If you are using old gcc, or very old
> Arm HW (that doesn't support aligned access), you shouldn't use this patch.
> >
> > I want to incorporate upstream patch changes related to the mozjs
> > library. Since version 60.9 is a tar bundle and not a Git source,
> > where can I find relevant solutions and reference links?
> >
> Mozilla primarily does development in their Mercurial repo, where you
> can also see the commit history[1]. Incidentally they have just
> announced hosting their code in their official Github repo also, where
> you can also browse the history[2] if you are more comfortable with that
> - mostly check in the js folder history.
>
> Of course, security-wise the best would be if you could migrate to newer
> versions. All of these are pretty old, and most probably having lots of
> issues that weren't found back when developers were still fixing them.
> (Not only mozjs, but whole Dunfell)
>
> [1]: https://hg-edge.mozilla.org/mozilla-central/
> [2]: https://github.com/mozilla-firefox/firefox
> >
> > I have reviewed Bugzilla IDs, and they indicate that the issue has
> > been fixed in example Firefox ESR78 and ESR128 and few mentioned <91
> > (Is that mean below 91 all versions may effect changes). However,
> > based on my understanding, adding those changes might result in
> > dependency package version issues, such as requiring a more recent
> > Python version (e.g., Python 3.10).
> >
> > I would appreciate any clarification on this matter.
> >
> > Thanks in advance.
> >
> > Best regards,
> >
> > Satish M
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#65341):
> https://lists.yoctoproject.org/g/yocto/message/65341
> > Mute This Topic: https://lists.yoctoproject.org/mt/113122170/6084445
> > Group Owner: yocto+owner@lists.yoctoproject.org
> > Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [
> skandigraun@gmail.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
>

[-- Attachment #2: Type: text/html, Size: 5047 bytes --]

Re: [yocto] mozjs 60.9 CVE issues fix.

[Gyorgy Sarvari]

On 5/15/25 10:30, sateesh m wrote:
>
> Thank you for your response. But i am having some doubts If I want to
> get upstream patches for the Firefox  60.9 version how to get it.
>
60.x ESR series is long abandoned, there are no upstream patches for it.
What are you trying to do? If you are trying to make it up to date
against today's known threats, that's realistically not doable. EOL
Yocto releases/recipes in general are not suitable for this.
If you have a more narrow goal, knowing it could help with getting
targeted, more useful answer on this list.
>
> Thanks & Regards,
> Satish M
>
>
> On Thu, 15 May, 2025, 12:22 pm Gyorgy Sarvari, <skandigraun@gmail.com>
> wrote:
>
>     On 5/15/25 06:34, sateesh m via lists.yoctoproject.org
>     <http://lists.yoctoproject.org> wrote:
>     >
>     > Hi Team,
>     >
>     > I am currently working on CVE-related issues in the mozjs
>     library that
>     > need to be fixed for version 60.9. I am using the Dunfell
>     branch, but
>     > upon comparing it to the Gatesgarth branch, I noticed an additional
>     > patch is available. The patch
>     > |file://0014-fallback-to-2011-C++-standard.patch| has been removed,
>     > and |0014-remove-JS_VOLATIME_ARM.patch| has been added instead.
>     >
>     > Could you confirm whether these changes need to be applied to my
>     local
>     > build as well? Additionally, I would like to understand the
>     reason for
>     > removing the fallback-to-2011 patch. If we retain it, could it
>     lead to
>     > any issues?
>     >
>     The patch comments look fairly descriptive. These are not security
>     fixes, rather change gcc compatibility.
>
>     0014-fallback-to-2011-C++-standard.patch - it was introduced because
>     Dunfell supported building on distros that came with an old gcc that
>     couldn't compile without this patch. But later Yocto releases dropped
>     support for these old distros, so this patch wasn't necessary. If your
>     compiler supports c++14, then this patch is optional for you, and
>     can be
>     safely dropped. But you can also keep it.
>
>     0014-remove-JS_VOLATIME_ARM.patch - This patch removes a
>     workaround that
>     was added to fix an old gcc bug. If you are using old gcc, or very old
>     Arm HW (that doesn't support aligned access), you shouldn't use
>     this patch.
>     >
>     > I want to incorporate upstream patch changes related to the mozjs
>     > library. Since version 60.9 is a tar bundle and not a Git source,
>     > where can I find relevant solutions and reference links?
>     >
>     Mozilla primarily does development in their Mercurial repo, where you
>     can also see the commit history[1]. Incidentally they have just
>     announced hosting their code in their official Github repo also, where
>     you can also browse the history[2] if you are more comfortable
>     with that
>     - mostly check in the js folder history.
>
>     Of course, security-wise the best would be if you could migrate to
>     newer
>     versions. All of these are pretty old, and most probably having
>     lots of
>     issues that weren't found back when developers were still fixing them.
>     (Not only mozjs, but whole Dunfell)
>
>     [1]: https://hg-edge.mozilla.org/mozilla-central/
>     [2]: https://github.com/mozilla-firefox/firefox
>     >
>     > I have reviewed Bugzilla IDs, and they indicate that the issue has
>     > been fixed in example Firefox ESR78 and ESR128 and few mentioned <91
>     > (Is that mean below 91 all versions may effect changes). However,
>     > based on my understanding, adding those changes might result in
>     > dependency package version issues, such as requiring a more recent
>     > Python version (e.g., Python 3.10).
>     >
>     > I would appreciate any clarification on this matter.
>     >
>     > Thanks in advance.
>     >
>     > Best regards,
>     >
>     > Satish M
>     >
>     >
>     > -=-=-=-=-=-=-=-=-=-=-=-
>     > Links: You receive all messages sent to this group.
>     > View/Reply Online (#65341):
>     https://lists.yoctoproject.org/g/yocto/message/65341
>     > Mute This Topic: https://lists.yoctoproject.org/mt/113122170/6084445
>     > Group Owner: yocto+owner@lists.yoctoproject.org
>     <mailto:yocto%2Bowner@lists.yoctoproject.org>
>     > Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub
>     [skandigraun@gmail.com]
>     > -=-=-=-=-=-=-=-=-=-=-=-
>     >
>