diff --git a/CVE-2023-25751.patch b/CVE-2023-25751.patch new file mode 100644 index 0000000000000000000000000000000000000000..dab967a1e9e264be1895630283f2f7114c1dce78 --- /dev/null +++ b/CVE-2023-25751.patch @@ -0,0 +1,42 @@ +From 0d657b29dc9939530315675ae5c984a858c450d1 Mon Sep 17 00:00:00 2001 +From: Iain Ireland +Date: Thu, 10 Oct 2024 14:56:26 +0800 +Subject: [PATCH] Add testcase r=jandem + +--- + js/src/jit-test/tests/ion/bug1814899.js | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + create mode 100644 js/src/jit-test/tests/ion/bug1814899.js + +diff --git a/js/src/jit-test/tests/ion/bug1814899.js b/js/src/jit-test/tests/ion/bug1814899.js +new file mode 100644 +index 0000000000..c5da6de864 +--- /dev/null ++++ b/js/src/jit-test/tests/ion/bug1814899.js +@@ -0,0 +1,23 @@ ++function bar(x) { ++ with ({}) {} ++ switch (x) { ++ case 1: ++ foo(2); ++ break; ++ case 2: ++ gczeal(14, 1); ++ break; ++ } ++ return "a sufficiently long string"; ++} ++ ++function foo(x) { ++ for (var s in bar(x)) { gczeal(0); } ++} ++ ++with ({}) {} ++for (var i = 0; i < 100; i++) { ++ foo(0); ++} ++foo(1); ++ +-- +2.27.0 + diff --git a/firefox.spec b/firefox.spec index 62a192e061a2388879282155250ca1ddc8a88034..50e615b72b1c3d55f556b070fe85553d6367bf97 100644 --- a/firefox.spec +++ b/firefox.spec @@ -88,7 +88,7 @@ Summary: Mozilla Firefox Web browser Name: firefox Version: 79.0 -Release: 32 +Release: 33 URL: https://www.mozilla.org/firefox/ License: MPLv1.1 or GPLv2+ or LGPLv2+ Source0: https://archive.mozilla.org/pub/firefox/releases/%{version}/source/firefox-%{version}.source.tar.xz @@ -213,6 +213,7 @@ Patch669: CVE-2021-23998.patch Patch670: CVE-2022-29912.patch Patch671: CVE-2024-0745.patch Patch672: CVE-2023-1945.patch +Patch673: CVE-2023-25751.patch %if %{?system_nss} BuildRequires: pkgconfig(nspr) >= %{nspr_version} pkgconfig(nss) >= %{nss_version} @@ -420,6 +421,7 @@ tar -xf %{SOURCE3} %patch670 -p1 %patch671 -p1 %patch672 -p1 +%patch673 -p1 %{__rm} -f .mozconfig %{__cp} %{SOURCE10} .mozconfig @@ -868,6 +870,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || : %endif %changelog +* Wed Aug 14 2024 happyworker <208suo@208suo.com> - 79.0-33 +- Fix CVE-2023-25751 + * Wed Aug 14 2024 happyworker <208suo@208suo.com> - 79.0-32 - Fix CVE-2023-1945