mozjs 60.9 CVE issues fix.

["sateesh m" <sateesh0457@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1276 bytes --]

Hi Team,

I am currently working on CVE-related issues in the mozjs library that need to be fixed for version 60.9. I am using the Dunfell branch, but upon comparing it to the Gatesgarth branch, I noticed an additional patch is available. The patch file://0014-fallback-to-2011-C++-standard.patch has been removed, and 0014-remove-JS_VOLATIME_ARM.patch has been added instead.

Could you confirm whether these changes need to be applied to my local build as well? Additionally, I would like to understand the reason for removing the fallback-to-2011 patch. If we retain it, could it lead to any issues?

I want to incorporate upstream patch changes related to the mozjs library. Since version 60.9 is a tar bundle and not a Git source, where can I find relevant solutions and reference links? I have reviewed Bugzilla IDs, and they indicate that the issue has been fixed in example Firefox ESR78 and ESR128 and few mentioned <91 (Is that mean below 91 all versions may effect changes). However, based on my understanding, adding those changes might result in dependency package version issues, such as requiring a more recent Python version (e.g., Python 3.10).

I would appreciate any clarification on this matter.

Thanks in advance.

Best regards,

Satish M

[-- Attachment #2: Type: text/html, Size: 1467 bytes --]