已关闭
fix(cve): 修复 CVE-2026-100776 在 mozjs140 中的漏洞 #19
infra_team创建于 14 天前关闭于 17 小时前
fix(cve): 修复 CVE-2026-100776 在 mozjs140 中的漏洞 #19
已关闭
共 2 个文件变更+13-4
| @@ -1,3 +1,3 @@ | |||
| 1 | version https://git-lfs.github.com/spec/v1 | 1 | version https://git-lfs.github.com/spec/v1 |
| 2 | -oid sha256:358bb03c550f95172f1e31694e4287da3411560df91e931cb25210efdf90e524 | 2 | +oid sha256:4d6ed3b18b2069c55bab12d8ba95da6013ac0b036d8a031df8b9f39a25d05c33 |
| 3 | -size 640054332 | 3 | +size 637640276 |
| @@ -3,6 +3,10 @@ | |||
| 3 | # LTO - Enable in Release builds, but consider disabling for development as it increases compile time | 3 | # LTO - Enable in Release builds, but consider disabling for development as it increases compile time |
| 4 | %global build_with_lto 1 | 4 | %global build_with_lto 1 |
| 5 | 5 | ||
| 6 | +# OOM: CI builder pods are capped at 16GB memory while rpm derives -j from the | ||
| 7 | +# host (64+ cores), so ~54 concurrent thin-LTO clang++ jobs get OOM-killed. | ||
| 8 | +%global _smp_mflags -j2 | ||
| 9 | + | ||
| 6 | # https://bugzilla.redhat.com/show_bug.cgi?id=2304756 | 10 | # https://bugzilla.redhat.com/show_bug.cgi?id=2304756 |
| 7 | %global toolchain clang | 11 | %global toolchain clang |
| 8 | 12 | ||
| @@ -25,8 +29,8 @@ | |||
| 25 | %endif | 29 | %endif |
| 26 | 30 | ||
| 27 | Name: mozjs%{major} | 31 | Name: mozjs%{major} |
| 28 | -Version: 140.15.0 | 32 | +Version: 140.17.0 |
| 29 | -Release: 1 | 33 | +Release: 2 |
| 30 | Summary: SpiderMonkey JavaScript library | 34 | Summary: SpiderMonkey JavaScript library |
| 31 | 35 | ||
| 32 | License: MPL-2.0 AND Apache-2.0 AND BSD-3-Clause AND BSD-2-Clause AND MIT AND GPL-3.0-or-later | 36 | License: MPL-2.0 AND Apache-2.0 AND BSD-3-Clause AND BSD-2-Clause AND MIT AND GPL-3.0-or-later |
| @@ -240,6 +244,11 @@ chmod -x %{buildroot}%{_includedir}/mozjs-%{major}/js-config.h | |||
| 240 | %{_includedir}/mozjs-%{major}/ | 244 | %{_includedir}/mozjs-%{major}/ |
| 241 | 245 | ||
| 242 | %changelog | 246 | %changelog |
| 247 | +* Wed Sep 30 2026 infra_team <zhaiwenjie1@huawei.com> - 140.17.0-2 | ||
| 248 | +- fix CVE: CVE-2026-100776 | ||
| 249 | +- update to 140.17.0, fix SpiderMonkey WebAssembly use-after-free (CWE-416) | ||
| 250 | +- cap build parallelism (-j2) to avoid OOM on 16GB-limited CI builders | ||
| 251 | + | ||
| 243 | * Tue Sep 01 2026 Funda Wang <fundawang@yeah.net> - 140.15.0-1 | 252 | * Tue Sep 01 2026 Funda Wang <fundawang@yeah.net> - 140.15.0-1 |
| 244 | - update to 140.15.0 | 253 | - update to 140.15.0 |
| 245 | 254 | ||