[Pkg-javascript-devel] Bug#1004288: iotjs: CVE-2021-46349 CVE-2021-46348 CVE-2021-46346 CVE-2021-46340 CVE-2021-46338

[Neil Williams]

Source: iotjs
Version: 1.0+715-1
Severity: important
Tags: security
X-Debbugs-Cc: codehelp at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for iotjs.

CVE-2021-46349[0]:
| There is an Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type ==
| ECMA_OBJECT_TYPE_PROXY' failed at /jerry-core/ecma/operations/ecma-
| objects.c in JerryScript 3.0.0.


CVE-2021-46348[1]:
| There is an Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)'
| failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript
| 3.0.0.


CVE-2021-46346[2]:
| There is an Assertion 'local_tza ==
| ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-
| core/ecma/builtin-objects/ecma-builtin-date-
| prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in
| JerryScript 3.0.0.


CVE-2021-46340[3]:
| There is an Assertion 'context_p->stack_top_uint8 ==
| SCAN_STACK_TRY_STATEMENT || context_p->stack_top_uint8 ==
| SCAN_STACK_CATCH_STATEMENT' failed at /parser/js/js-
| scanner.c(scanner_scan_statement_end) in JerryScript 3.0.0.


CVE-2021-46338[4]:
| There is an Assertion 'ecma_is_lexical_environment (object_p)' failed
| at /base/ecma-helpers.c(ecma_get_lex_env_type) in JerryScript 3.0.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-46349
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46349
[1] https://security-tracker.debian.org/tracker/CVE-2021-46348
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46348
[2] https://security-tracker.debian.org/tracker/CVE-2021-46346
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46346
[3] https://security-tracker.debian.org/tracker/CVE-2021-46340
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46340
[4] https://security-tracker.debian.org/tracker/CVE-2021-46338
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46338

Please adjust the affected versions in the BTS as needed.



-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.15.0-2-amd64 (SMP w/16 CPU threads)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled