** Description changed: Impact ------ mozjs is Firefox's Spidermonkey JavaScript engine. mozjs52 is derived from Firefox 52 ESR. 52.9 is the final scheduled release in the 52 series. (mozjs itself never got "official releases" from Mozilla.) By comparing the bug numbers in the release notes with the bug numbers mentioned at https://github.com/mozilla/gecko-dev/commits/esr52/js/src/ - it looks like the new release includes fixes for one or more memory - safety bugs identified as CVE-2018-5188. + it looks like the new release includes one or more memory safety bugs + identified as CVE-2018-5188. GNOME Shell (Ubuntu's default interface in Ubuntu 18.04 LTS) requires mozjs52. Nothing else in Ubuntu 18.04 LTS uses mozjs52. References ---------- https://www.mozilla.org/en-US/firefox/52.9.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/ https://wiki.ubuntu.com/SecurityTeam/FAQ#mozjs Test Case --------- Install the update. Restart your computer. Log in and make sure the default desktop still works. Regression Potential -------------------- This is a minor release in the long-term support series. I count about 6 cherry-picked targeted commits. Other Info ---------- - I believe the version in Ubuntu 18.10 (synced with Debian) goes back to building with the distro's ICU library instead of the bundled version. Maybe we should backport from 18.10 instead of a more minimal diff against the Ubuntu version. + I believe the version in Ubuntu 18.10 (synced with Debian) goes back to building with the distro's ICU library instead of the bundled version. Maybe we should backport from 18.10 instead of a more minimal diff against the Ubuntu version. I did verify that a backport builds on Ubuntu 18.04 LTS. A diff of the 18.10 version is at https://launchpad.net/ubuntu/+source/mozjs52/52.9.1-1
-- You received this bug notification because you are a member of Desktop Packages, which is subscribed to mozjs52 in Ubuntu. https://bugs.launchpad.net/bugs/1784974 Title: Update mozjs52 to 52.1.9 Status in mozjs52 package in Ubuntu: Fix Released Status in mozjs52 source package in Bionic: Triaged Bug description: Impact ------ mozjs is Firefox's Spidermonkey JavaScript engine. mozjs52 is derived from Firefox 52 ESR. 52.9 is the final scheduled release in the 52 series. (mozjs itself never got "official releases" from Mozilla.) By comparing the bug numbers in the release notes with the bug numbers mentioned at https://github.com/mozilla/gecko- dev/commits/esr52/js/src/ it looks like the new release includes one or more memory safety bugs identified as CVE-2018-5188. GNOME Shell (Ubuntu's default interface in Ubuntu 18.04 LTS) requires mozjs52. Nothing else in Ubuntu 18.04 LTS uses mozjs52. References ---------- https://www.mozilla.org/en-US/firefox/52.9.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/ https://wiki.ubuntu.com/SecurityTeam/FAQ#mozjs Test Case --------- Install the update. Restart your computer. Log in and make sure the default desktop still works. Regression Potential -------------------- This is a minor release in the long-term support series. I count about 6 cherry-picked targeted commits. Other Info ---------- I believe the version in Ubuntu 18.10 (synced with Debian) goes back to building with the distro's ICU library instead of the bundled version. Maybe we should backport from 18.10 instead of a more minimal diff against the Ubuntu version. I did verify that a backport builds on Ubuntu 18.04 LTS. A diff of the 18.10 version is at https://launchpad.net/ubuntu/+source/mozjs52/52.9.1-1 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mozjs52/+bug/1784974/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
