xorg-server (2:21.1.4-2ubuntu1.7~22.04.12) jammy-security; urgency=medium
* SECURITY UPDATE: Heap-based buffer overflow in _XkbSetCompatMap
- debian/patches/CVE-2024-9632.patch: properly update size in
xkb/xkb.c.
- CVE-2024-9632
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 11 Oct 2024 10:23:05 -0400
xorg-server (2:21.1.4-2ubuntu1.7~22.04.11) jammy; urgency=medium
* d/p/fix-suspend-resume-with-no-input-device.patch (LP: #2056331)
- Make sure info->active and info->vt_active are false
after dropping drm master.
- Normally, this is done when pausing the first
input device, so it breaks when there are no
input device at all.
-- Talha Can Havadar <talha.can.havadar@canonical.com> Fri, 12 Apr 2024 16:23:18 +0200
xorg-server (2:21.1.4-2ubuntu1.7~22.04.10) jammy-security; urgency=medium
* SECURITY REGRESSION: Avoid possible double-free
- debian/patches/CVE-2024-31083-regression.patch:
fix a regression caused for a double-free at the last
changes fixed by CVE-2024-31083 (LP: #2060354)
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Tue, 09 Apr 2024 00:18:52 -0300
xorg-server (2:21.1.4-2ubuntu1.7~22.04.9) jammy-security; urgency=medium
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31080.patch: fixes byte
swapping in replies in Xi/xiselectev.c.
- CVE-2024-31080
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31081.patch: fixes byte
swapping in replies in Xi/xipassivegrab.c.
- CVE-2024-31081
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31082.patch: makes
ProcAppleDRICreatePixmap use unswapped length to
send reply in hw/xquartz/xpr/appledir.c.
- CVE-2024-31082
* SECURITY UPDATE: User-after-free
- debian/patches/CVE-2024-31083.patch: fix recounting of glyphs
during ProcRenderAddGlyphs in render/glyph.c.
- CVE-2024-31083
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Mon, 01 Apr 2024 17:24:38 -0300
xorg-server (2:21.1.4-2ubuntu1.7~22.04.8) jammy-security; urgency=medium
* SECURITY REGRESSION: memory leak due to incomplete fix (LP: #2051536)
- debian/patches/CVE-2024-21886-3.patch: fix use after free in input
device shutdown in dix/devices.c.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 29 Jan 2024 07:43:15 -0500
xorg-server (2:21.1.4-2ubuntu1.7~22.04.7) jammy-security; urgency=medium
* SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
ProcXIQueryPointer
- debian/patches/CVE-2023-6816.patch: allocate enough space for logical
button maps in Xi/xiquerypointer.c, dix/enterleave.c.
- CVE-2023-6816
* SECURITY UPDATE: Reattaching to different master device may lead to
out-of-bounds memory access
- debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
our DeviceStateNotify in dix/enterleave.c.
- debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
calculation in dix/enterleave.c.
- debian/patches/CVE-2024-0229-3.patch: when creating a new
ButtonClass, set the number of buttons in Xi/exevents.c.
- debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
device for XIAttachToMaster in Xi/xichangehierarchy.c.
- CVE-2024-0229
* SECURITY UPDATE: SELinux unlabeled GLX PBuffer
- debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
in glx/glxcmds.c.
- CVE-2024-0408
* SECURITY UPDATE: SELinux context corruption
- debian/patches/CVE-2024-0409.patch: use the proper private key for
cursor in hw/kdrive/ephyr/ephyrcursor.c.
- CVE-2024-0409
* SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
- debian/patches/CVE-2024-21885.patch: flush hierarchy events after
adding/removing master devices in Xi/xichangehierarchy.c.
- CVE-2024-21885
* SECURITY UPDATE: Heap buffer overflow in DisableDevice
- debian/patches/CVE-2024-21886-1.patch: do not keep linked list
pointer during recursion in dix/devices.c.
- debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
disabled slaved devices too in dix/devices.c.
- CVE-2024-21886
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 15 Jan 2024 10:45:41 -0500
xorg-server (2:21.1.4-2ubuntu1.7~22.04.5) jammy-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds memory write in XKB button actions
- debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for
our buttons in Xi/exevents.c, dix/devices.c.
- CVE-2023-6377
* SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty
and RRChangeProviderProperty
- debian/patches/CVE-2023-6478.patch: avoid integer truncation in
length check of ProcRRChange*Property in randr/rrproperty.c,
randr/rrproviderproperty.c.
- CVE-2023-6478
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 12 Dec 2023 20:28:33 -0500
xorg-server (2:21.1.4-2ubuntu1.7~22.04.2) jammy-security; urgency=medium
* SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
RRChangeOutputProperty
- debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
- CVE-2023-5367
* SECURITY UPDATE: Use-after-free bug in DestroyWindow
- debian/patches/CVE-2023-5380.patch: reset the PointerWindows
reference on screen switch in dix/enterleave.h, include/eventstr.h,
mi/mipointer.c.
- CVE-2023-5380
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 23 Oct 2023 12:30:42 -0400
xorg-server (2:21.1.4-2ubuntu1.7~22.04.1) jammy; urgency=medium
* Backport to jammy. (LP: #2009767)
-- Timo Aaltonen <tjaalton@debian.org> Tue, 04 Apr 2023 09:20:09 +0300
xorg-server (2:21.1.4-2ubuntu1.7) kinetic-security; urgency=medium
* SECURITY UPDATE: Overlay Window Use-After-Free
- debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in
composite/compwindow.c.
- CVE-2023-1393
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 29 Mar 2023 08:50:21 -0400
# For older changelog entries, run 'apt-get changelog xserver-xephyr'
Generated by dwww version 1.14 on Thu Jan 23 03:35:31 CET 2025.