Subject: CVS commit: pkgsrc/lang/spidermonkey52
From: Maya Rashish
Date: 2018-10-03 20:58:23
Message id: 20181003185823.16DBAFBEE@cvs.NetBSD.org

Log Message:
spidermonkey52: backport patch for CVE-2018-12387

Don't inline push with more than 1 argument

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push \ 
with multiple arguments that results in the stack pointer being off by 8 bytes \ 
after a bailout. This leaks a memory address to the calling function which can \ 
be used as part of an exploit inside the sandboxed content process.

Bump PKGREVISION

Files:
RevisionActionfile
1.10modifypkgsrc/lang/spidermonkey52/Makefile
1.5modifypkgsrc/lang/spidermonkey52/distinfo
1.1addpkgsrc/lang/spidermonkey52/patches/patch-CVE-2018-12387