- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202412-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Spidermonkey: Multiple Vulnerabilities
Date: December 08, 2024
Bugs: #935552, #936217, #937469, #941176
ID: 202412-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in Spidermonkey, the worst
of which could lead to arbitrary code execution.

Background
==========

SpiderMonkey is Mozilla’s JavaScript and WebAssembly Engine, used in
Firefox, Servo and various other projects. It is written in C++, Rust
and JavaScript. You can embed it into C++ and Rust projects, and it can
be run as a stand-alone shell.

Affected packages
=================

Package Vulnerable Unaffected
--------------------- -------------- ---------------
dev-lang/spidermonkey < 115.15.0:115 >= 115.15.0:115
< 115.15.0 >= 115.15.0

Description
===========

Multiple vulnerabilities have been discovered in Spidermonkey. Please
review the CVE identifiers referenced below for details.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Spidermonkey users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/spidermonkey-115.15.0:115"

References
==========

[ 1 ] CVE-2024-5693
https://nvd.nist.gov/vuln/detail/CVE-2024-5693
[ 2 ] CVE-2024-5696
https://nvd.nist.gov/vuln/detail/CVE-2024-5696
[ 3 ] CVE-2024-5700
https://nvd.nist.gov/vuln/detail/CVE-2024-5700
[ 4 ] CVE-2024-6601
https://nvd.nist.gov/vuln/detail/CVE-2024-6601
[ 5 ] CVE-2024-6602
https://nvd.nist.gov/vuln/detail/CVE-2024-6602
[ 6 ] CVE-2024-6603
https://nvd.nist.gov/vuln/detail/CVE-2024-6603
[ 7 ] CVE-2024-6604
https://nvd.nist.gov/vuln/detail/CVE-2024-6604
[ 8 ] CVE-2024-7518
https://nvd.nist.gov/vuln/detail/CVE-2024-7518
[ 9 ] CVE-2024-7519
https://nvd.nist.gov/vuln/detail/CVE-2024-7519
[ 10 ] CVE-2024-7520
https://nvd.nist.gov/vuln/detail/CVE-2024-7520
[ 11 ] CVE-2024-7521
https://nvd.nist.gov/vuln/detail/CVE-2024-7521
[ 12 ] CVE-2024-7522
https://nvd.nist.gov/vuln/detail/CVE-2024-7522
[ 13 ] CVE-2024-7523
https://nvd.nist.gov/vuln/detail/CVE-2024-7523
[ 14 ] CVE-2024-7524
https://nvd.nist.gov/vuln/detail/CVE-2024-7524
[ 15 ] CVE-2024-7525
https://nvd.nist.gov/vuln/detail/CVE-2024-7525
[ 16 ] CVE-2024-7526
https://nvd.nist.gov/vuln/detail/CVE-2024-7526
[ 17 ] CVE-2024-7527
https://nvd.nist.gov/vuln/detail/CVE-2024-7527
[ 18 ] CVE-2024-7528
https://nvd.nist.gov/vuln/detail/CVE-2024-7528
[ 19 ] CVE-2024-7529
https://nvd.nist.gov/vuln/detail/CVE-2024-7529
[ 20 ] CVE-2024-7531
https://nvd.nist.gov/vuln/detail/CVE-2024-7531
[ 21 ] CVE-2024-8381
https://nvd.nist.gov/vuln/detail/CVE-2024-8381
[ 22 ] CVE-2024-8382
https://nvd.nist.gov/vuln/detail/CVE-2024-8382
[ 23 ] CVE-2024-8383
https://nvd.nist.gov/vuln/detail/CVE-2024-8383
[ 24 ] CVE-2024-8384
https://nvd.nist.gov/vuln/detail/CVE-2024-8384
[ 25 ] CVE-2024-8385
https://nvd.nist.gov/vuln/detail/CVE-2024-8385
[ 26 ] CVE-2024-8386
https://nvd.nist.gov/vuln/detail/CVE-2024-8386
[ 27 ] CVE-2024-8387
https://nvd.nist.gov/vuln/detail/CVE-2024-8387
[ 28 ] CVE-2024-8389
https://nvd.nist.gov/vuln/detail/CVE-2024-8389
[ 29 ] CVE-2024-8394
https://nvd.nist.gov/vuln/detail/CVE-2024-8394
[ 30 ] MFSA-2024-25
[ 31 ] MFSA-2024-26
[ 32 ] MFSA-2024-28
[ 33 ] MFSA2024-29
[ 34 ] MFSA2024-30
[ 35 ] MFSA2024-31
[ 36 ] MFSA2024-33
[ 37 ] MFSA2024-34
[ 38 ] MFSA2024-35
[ 39 ] MFSA2024-38
[ 40 ] MFSA2024-39
[ 41 ] MFSA2024-40
[ 42 ] MFSA2024-41
[ 43 ] MFSA2024-43
[ 44 ] MFSA2024-44

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202412-13

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmdVWS8ACgkQFMQkOaVy +9mBDQ/+OupPYtxhAsd8rh7vCPbsNwJHNAbMXVyHyAhX2+InihXEh2cupRhzpgAv 4tXfCG0dlhP1rhF4To/FP2kYZI0EmVSUj2Kz35Z4cz8pbVbBO2DMMd1pEfrLjWis cpXfZx2XJp64Nf5WW0xje/61qgmxjzc4rQ6zFe3Y24QtQwJRPfTUTBXKNY0GGcUR 5ObxJln5+P2yXIGxYKpgSnwWnxStVfVv3pr2O4s4qDNweR23z0ozTwGgIqENLANx 4N+/z36D6+Mmy4z/HWpjA62IHi+DausEONdyz4i7VYbFTHjoMIwUcsrVkbYoQG8T KU/pKvk7Zp5hB94NAktu0RaCII6BQuvyKW3eAjtfsfnnZC76Q5Sq5xqLjc/SVN4n Dc3c/I7EHByklaVYiQh9aTYTZRYKWVhAdq9Yyvgo1iJdi+A43Chpp+891diqrfse 0+v0HZJny6wlMyJRxqISY2BAIK70nlJDn4iKwrm0xftFf/cP4+RZgPA6DauGqwTb uDsOka9GFtB9iQC0uC3ttyVn+hFOB902lx7IAr+BbFn5tJkEHDEhexMQEyeCdaAB WnTl4MTyFA38fqvovzdl4QpvwjXZgJE/wQ3DnZNmAS4BFlPChHwjK2s9dbDlq5nD w/dtC1IBG09q6zufE7anKCHjtErZ4UBV8WFpPId3JGnMT0/E2qA=
=Vsi1
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)