JavaScript engine
facebook:hermes from the portAn error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not aff…
An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not …
A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted…
A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications …
A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence…
pkg audit reports nothing for this version.*/*: CMake 4 compatibility PR: 29531946451ea56c
*/*: Bump consumers of devel/icu ...to avoid library mismatchesff33dd4700
lang/hermes: update 0.12.0 → 0.13.0 Reported by: portscout1d87a291ed
devel/icu: update to 74.1 Changes: https://github.com/unicode-org/icu/releases/tag/release-74-1 Reported by: GitHub (watch releases) PR: 274317 Exp-run by: antoine (incomplete) Approved by: fluffye55b80195e
devel/icu: update to 73.1 - Temporarily switch to GitHub auto archive (release artifacts are N/A atm) Changes: https://github.com/unicode-org/icu/releases/tag/release-73-1 Reported by: GitHub (watch releases) PR: 270422 Exp-run by: antoinef1f1a8be88
devel/icu: update to 72.1 Changes: https://github.com/unicode-org/icu/releases/tag/release-72-1 Reported by: GitHub (watch releases) PR: 266582 Exp-run by: antoinedfe25d73e7
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
lang/hermes: Update 0.11.0 -> 0.12.0 Reported by: portscout44a590c56e
devel/icu: update to 71.1 Changes: https://github.com/unicode-org/icu/releases/tag/release-71-1 Reported by: GitHub (watch releases) PR: 262654 Exp-run by: antoine Approved by: fluffy268cee3b02
lang/hermes: Update 0.10.0 -> 0.11.0 Reported by: portscoutc7272116af
lang/hermes: Update 0.9.0 -> 0.10.0 Reported by: portscout02f7725cc5
devel/icu: update to 70.1 Changes: https://github.com/unicode-org/icu/releases/tag/release-70-1 Reported by: GitHub (watch releases) PR: 258794 Exp-run by: antoinef34ece3aa6
cleanup: drop support for EOL FreeBSD 11.X Search criteria used: - 11.4 - OSREL* - OSVER* - *_FreeBSD_11 Input from: - adridg: devel/qca-legacy - jbeich: _WITH_DPRINTF, _WITH_GETLINE, GNU bfd workarounds - sunpoet: security/p5-*OpenSSL* Reviewed by: doceng, kde, multimedia, perl, python, ruby, rust Differential Revision: https://reviews.freebsd.org/D32008 Test Plan: make index620968a43a
lang/hermes: Add CPE information Approved by: portmgr (blanket)7c1d6fcffe
lang/hermes: Update 0.8.1 -> 0.9.0 Reported by: portscout1cb5f4d35c
lang/hermes: Update 0.8.0 -> 0.8.1 Reported by: portscoutdfac419ee6
lang/hermes: Update 0.7.2.20210322 -> 0.8.0 Reported by: portscoutd35493cb6f
devel/icu: update to 69.1 Changes: https://github.com/unicode-org/icu/releases/tag/release-69-1 Reported by: GitHub (watch releases)69d24a727d
One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
lang/hermes: Make Python an explicit build dependency (D29353) This unbreaks the build when using devel/samurai. It previously was available in the configure phase through ninja which has a run dependency on Python. =======================<phase: configure >============================ ===> Missing "/usr/local/bin/python3.7" to create a binary alias at "/wrkdirs/usr/ports/lang/hermes/work/.bin/python" http://package18.nyi.freebsd.org/data/122amd64-default-foo/2021-04-04_07h37m38s/logs/errors/hermes-javascript-engine-0.7.2.20210322.log PR: 25467831bf1886ed
Remove # $FreeBSD$ from Makefiles.305f148f48
lang/hermes: Update 0.7.2.20210305 -> 0.7.2.20210322542ebcbf91
lang/hermes: Update 0.7.2.20201216 -> 0.7.2.20210305b099efa801
lang/hermes: Update 0.7.0 -> 0.7.2.20201216661fe2ab2b
devel/icu: update to 68.1 Changes: http://site.icu-project.org/download/68 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ Reported by: GitHub (watch releases)6d5d6429d5
lang/hermes: Broken on i386 Reported by: falloutc2dce588a5
lang/hermes: Update 0.5.2-rc1 -> 0.7.0 Reported by: portscoute1ba1ef2cd
Make BROKEN message more explicit, for ease in analyzing package building results.37944610e7
New port: lang/hermes: JavaScript enginef05a6f94a3