Update mozjs102 to 102.13.0
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| mozjs102 (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Jammy |
Fix Released
|
Undecided
|
Marc Deslauriers | ||
| Kinetic |
Fix Released
|
Undecided
|
Marc Deslauriers | ||
| Lunar |
Fix Released
|
Undecided
|
Marc Deslauriers | ||
Bug Description
Impact
------
mozjs102 is the SpiderMonkey JavaScript engine from Firefox ESR. It is used by gjs to power GNOME Shell and some GNOME apps.
There are new Firefox 102 ESR releases monthly until the end of August.
https:/
Security Impact
---------------
I looked through
https:/
and searched for referenced bug numbers in
https:/
and found two CVEs
CVE-2023-37202: Potential use-after-free from compartment mismatch in SpiderMonkey
CVE-2023-37211: Memory safety bugs
Test Case
---------
https:/
Additionally, mozjs102 has build tests. mozjs102 does not have autopkgtests of its own but it triggers the gjs autopkgtests.
Security Sponsoring
-------------------
sudo apt install git-buildpackage
mkdir tarballs; cd ../tarballs
pull-lp-source mozjs102 mantic
# That avoids needing to recreate the original tarball from pristine-tar which takes a while. Also, running lintian takes a while.
cd ..
gbp clone https:/
cd mozjs
git checkout ubuntu/102/lunar
gbp buildpackage --git-builder=
git checkout ubuntu/102/kinetic
gbp buildpackage --git-builder=
git checkout ubuntu/102/jammy
gbp buildpackage --git-builder=
Initial Testing Done
-------
I built the package locally.
I installed the library package on Ubuntu 23.04 and successfully completed the Test Case.
Other Info
----------
It is believed that the only thing using mozjs102 in Ubuntu 22.04 LTS is actually cjs in Linux Mint 21.2 (in Beta testing). It has been proposed to switch Ubuntu's gjs to use it there also but that is currently on hold (benefit/risk analysis). See LP: #1993214
CVE References
| description: | updated |
| Changed in mozjs102 (Ubuntu Jammy): | |
| status: | New → Confirmed |
| Changed in mozjs102 (Ubuntu Kinetic): | |
| status: | New → Confirmed |
| Changed in mozjs102 (Ubuntu Lunar): | |
| status: | New → Confirmed |
| Launchpad Janitor (janitor) wrote | #1 |
| Changed in mozjs102 (Ubuntu): | |
| status: | Fix Committed → Fix Released |
| Changed in mozjs102 (Ubuntu Jammy): | |
| status: | Confirmed → In Progress |
| Changed in mozjs102 (Ubuntu Kinetic): | |
| status: | Confirmed → In Progress |
| Changed in mozjs102 (Ubuntu Lunar): | |
| status: | Confirmed → In Progress |
| Changed in mozjs102 (Ubuntu Jammy): | |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in mozjs102 (Ubuntu Kinetic): | |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in mozjs102 (Ubuntu Lunar): | |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Launchpad Janitor (janitor) wrote | #2 |
| Changed in mozjs102 (Ubuntu Lunar): | |
| status: | In Progress → Fix Released |
| Launchpad Janitor (janitor) wrote | #3 |
| Changed in mozjs102 (Ubuntu Kinetic): | |
| status: | In Progress → Fix Released |
| Launchpad Janitor (janitor) wrote | #4 |
| Changed in mozjs102 (Ubuntu Jammy): | |
| status: | In Progress → Fix Released |
This bug was fixed in the package mozjs102 - 102.13.0-1
---------------
mozjs102 (102.13.0-1) unstable; urgency=high
* New upstream release (LP: #2026197)
- CVE-2023-37202: Potential use-after-free from compartment mismatch
in SpiderMonkey
- CVE-2023-37211: Memory safety bugs
-- Jeremy Bícha <email address hidden> Wed, 05 Jul 2023 09:05:35 -0400