Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 737020 (CVE-2020-24343) - dev-lang/mujs: Use-after-free vulnerability (CVE-2020-24343)
Summary: dev-lang/mujs: Use-after-free vulnerability (CVE-2020-24343)
Status: RESOLVED INVALID
Alias: CVE-2020-24343
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/ccxvii/mujs/issues...
Whiteboard: B4 [ebuild/upstream]
Keywords:
Depends on:
Blocks: 737034
  Show dependency tree
 
Reported: 2020-08-13 23:17 UTC by John Helmert III
Modified: 2020-08-14 04:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-08-13 23:17:41 UTC 
CVE-2020-24343:

Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.


Patch: https://github.com/ccxvii/mujs/commit/ed33bc01d5f4e9a736830d706371163ab2db8e5a
Comment 1 Larry the Git Cow gentoo-dev 2020-08-14 04:21:29 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0985c4811a165c289d7cde5a81ea960077d7a235

commit 0985c4811a165c289d7cde5a81ea960077d7a235
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2020-08-14 04:09:42 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2020-08-14 04:21:22 +0000

    app-text/mupdf: security bump to 1.17.0
    
    * Debundle dev-lang/mujs again for the
      security bug (bundled copy is probably OK
      in terms of release mujs, but not a new bug
      (CVE-2020-24343).
    
    * Document bundled libs with references
      to check when bumping. Useful for both
      security@ and the maintainer.
    
    * Include extra Debian patches for improved
      cross-compilation support (mostly pkg-config).
    
    * Fix existing patch to respect libdir in pkgconfig
      file.
    
    * Fix missing || dies.
    
    Bug: https://bugs.gentoo.org/737034
    Bug: https://bugs.gentoo.org/737020
    Closes: https://bugs.gentoo.org/725672
    Closes: https://bugs.gentoo.org/734898
    Package-Manager: Portage-3.0.2, Repoman-2.3.23
    Signed-off-by: Sam James <sam@gentoo.org>

 app-text/mupdf/Manifest                            |   1 +
 .../mupdf/files/mupdf-1.17.0-cross-fixes.patch     | 103 ++++++++++++++
 app-text/mupdf/mupdf-1.17.0.ebuild                 | 153 +++++++++++++++++++++
 3 files changed, 257 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-08-14 04:24:19 UTC 
This CVE is for an issue that was introduced in git but not included in any release. CVE description is wrong, and we are not affected.