[Pkg-javascript-devel] Bug#694808: libv8: CVE-2012-5120 CVE-2012-5128

[Jérémy Lal]

On 02/01/2013 19:00, Moritz Muehlenhoff wrote:
> On Sun, Dec 16, 2012 at 11:08:34PM +0100, Jérémy Lal wrote:
>> On 16/12/2012 23:00, Allison Randal wrote:
>>> The details on these two CVE's are 403 for me:
>>>
>>> CVE-2012-5120
>>> https://code.google.com/p/chromium/issues/detail?id=150729
>>>
>>> CVE-2012-5128
>>> https://code.google.com/p/chromium/issues/detail?id=157124
>>>
>>> So presumably they're still embargoed and only accessible to certain
>>> members of pkg-javascript.
>>
>> Yes, they are.
>> I asked Chris (cc-ed to Giuseppe) access to those.
> 
> Did you get a reply?


Unfortunately i still don't get an access.
Fortunately it's possible to find which upstream v8 commits are
fixing those CVE.

>>> CVE-2012-5120
>>> https://code.google.com/p/chromium/issues/detail?id=150729

is tested by
http://code.google.com/p/v8/source/browse/trunk/test/mjsunit/regress/regress-crbug-150729.js
and
./d8 --allow-natives-syntax regress-crbug-150729.js
doesn't crash in any way when run against libv8 3.8.9.20-2

>>> CVE-2012-5128
>>> https://code.google.com/p/chromium/issues/detail?id=157124

is fixed by
http://code.google.com/p/v8/source/detail?r=12785
and the cctest within runs fine on libv8 3.8.9.20-2 test suite.

Conclusion : those two CVE do not hit libv8 that is in debian.

Jérémy



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-javascript-devel/attachments/20130120/9839772f/attachment.pgp>