-
xwayland (2:22.1.1-1ubuntu0.13) jammy-security; urgency=medium
* SECURITY REGRESSION: Avoid possible double-free
- debian/patches/CVE-2024-31083-regression.patch:
fix a regression caused for a double-free at the last
changes fixed by CVE-2024-31083 (LP: #2060354)
-- Leonidas Da Silva Barbosa <email address hidden> Mon, 08 Apr 2024 22:13:22 -0300
-
xwayland (2:22.1.1-1ubuntu0.12) jammy-security; urgency=medium
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31080.patch: fixes byte
swapping in replies in Xi/xiselectev.c.
- CVE-2024-31080
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31081.patch: fixes byte
swapping in replies in Xi/xipassivegrab.c.
- CVE-2024-31081
* SECURITY UPDATE: User-after-free
- debian/patches/CVE-2024-31083.patch: fix recounting of glyphs
during ProcRenderAddGlyphs in render/glyph.c.
- CVE-2024-31083
-- Leonidas Da Silva Barbosa <email address hidden> Tue, 02 Apr 2024 14:08:05 -0300
-
xwayland (2:22.1.1-1ubuntu0.11) jammy-security; urgency=medium
* SECURITY REGRESSION: memory leak due to incomplete fix (LP: #2051536)
- debian/patches/CVE-2024-21886-3.patch: fix use after free in input
device shutdown in dix/devices.c.
-- Marc Deslauriers <email address hidden> Mon, 29 Jan 2024 07:51:17 -0500
-
xwayland (2:22.1.1-1ubuntu0.10) jammy-security; urgency=medium
* SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
ProcXIQueryPointer
- debian/patches/CVE-2023-6816.patch: allocate enough space for logical
button maps in Xi/xiquerypointer.c, dix/enterleave.c.
- CVE-2023-6816
* SECURITY UPDATE: Reattaching to different master device may lead to
out-of-bounds memory access
- debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
our DeviceStateNotify in dix/enterleave.c.
- debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
calculation in dix/enterleave.c.
- debian/patches/CVE-2024-0229-3.patch: when creating a new
ButtonClass, set the number of buttons in Xi/exevents.c.
- debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
device for XIAttachToMaster in Xi/xichangehierarchy.c.
- CVE-2024-0229
* SECURITY UPDATE: SELinux unlabeled GLX PBuffer
- debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
in glx/glxcmds.c.
- CVE-2024-0408
* SECURITY UPDATE: SELinux context corruption
- debian/patches/CVE-2024-0409.patch: use the proper private key for
cursor in hw/xwayland/xwayland-cursor.c.
- CVE-2024-0409
* SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
- debian/patches/CVE-2024-21885.patch: flush hierarchy events after
adding/removing master devices in Xi/xichangehierarchy.c.
- CVE-2024-21885
* SECURITY UPDATE: Heap buffer overflow in DisableDevice
- debian/patches/CVE-2024-21886-1.patch: do not keep linked list
pointer during recursion in dix/devices.c.
- debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
disabled slaved devices too in dix/devices.c.
- CVE-2024-21886
-- Marc Deslauriers <email address hidden> Mon, 15 Jan 2024 13:08:16 -0500
-
xwayland (2:22.1.1-1ubuntu0.9) jammy-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds memory write in XKB button actions
- debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for
our buttons in Xi/exevents.c, dix/devices.c.
- CVE-2023-6377
* SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty
and RRChangeProviderProperty
- debian/patches/CVE-2023-6478.patch: avoid integer truncation in
length check of ProcRRChange*Property in randr/rrproperty.c,
randr/rrproviderproperty.c.
- CVE-2023-6478
-- Marc Deslauriers <email address hidden> Tue, 12 Dec 2023 20:32:35 -0500
-
xwayland (2:22.1.1-1ubuntu0.7) jammy-security; urgency=medium
* SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
RRChangeOutputProperty
- debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
- CVE-2023-5367
-- Marc Deslauriers <email address hidden> Mon, 16 Oct 2023 09:20:53 -0400
-
xwayland (2:22.1.1-1ubuntu0.6) jammy-security; urgency=medium
* SECURITY UPDATE: Overlay Window Use-After-Free
- debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in
composite/compwindow.c.
- CVE-2023-1393
-- Marc Deslauriers <email address hidden> Wed, 29 Mar 2023 09:05:35 -0400
-
xwayland (2:22.1.1-1ubuntu0.5) jammy-security; urgency=medium
* SECURITY UPDATE: DeepCopyPointerClasses use-after-free
- debian/patches/CVE-2023-0494.patch: fix potential use-after-free in
Xi/exevents.c.
- CVE-2023-0494
-- Marc Deslauriers <email address hidden> Tue, 07 Feb 2023 08:06:17 -0500
-
xwayland (2:22.1.1-1ubuntu0.4) jammy-security; urgency=medium
* SECURITY UPDATE: XTestSwapFakeInput stack overflow
- debian/patches/CVE-2022-46340.patch: disallow GenericEvents in
XTestSwapFakeInput in Xext/xtest.c.
- CVE-2022-46340
* SECURITY UPDATE: XIPassiveUngrabDevice out-of-bounds access
- debian/patches/CVE-2022-46341.patch: disallow passive grabs with a
detail > 255 in Xi/xipassivegrab.c.
- CVE-2022-46341
* SECURITY UPDATE: XvdiSelectVideoNotify use-after-free
- debian/patches/CVE-2022-46342.patch: free the XvRTVideoNotify when
turning off from the same client in Xext/xvmain.c.
- CVE-2022-46342
* SECURITY UPDATE: ScreenSaverSetAttributes use-after-free
- debian/patches/CVE-2022-46343.patch: free the screen saver resource
when replacing it in Xext/saver.c.
- CVE-2022-46343
* SECURITY UPDATE: XIChangeProperty out-of-bounds access
- debian/patches/CVE-2022-46344-1.patch: return an error from XI
property changes if verification failed in Xi/xiproperty.c.
- debian/patches/CVE-2022-46344-2.patch: avoid integer truncation in
length check of ProcXIChangeProperty in Xi/xiproperty.c.
- CVE-2022-46344
* SECURITY UPDATE: XkbGetKbdByName use-after-free
- debian/patches/CVE-2022-4283.patch: reset the radio_groups pointer to
NULL after freeing it in xkb/xkbUtils.c.
- CVE-2022-4283
-- Marc Deslauriers <email address hidden> Wed, 07 Dec 2022 09:12:14 -0500
-
xwayland (2:22.1.1-1ubuntu0.3) jammy-security; urgency=medium
* SECURITY UPDATE: GetCountedString Buffer Overflow
- debian/patches/CVE-2022-3550.patch: add a check for client->req_len
size for _GetCountedString in xkb/xkb.c.
- CVE-2022-3550
* SECURITY UPDATE: ProcXkbGetKbdByName Memory Leak
- debian/patches/CVE-2022-3551.patch: add calls to free allocated
memory if the execution reaches failures in ProcXkbGetKbdByName
in xkb/xkb.c.
- CVE-2022-3551
-- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 22 Nov 2022 16:24:55 -0300
-
xwayland (2:22.1.1-1ubuntu0.2) jammy; urgency=medium
* Add xwayland-Detect-gbm_bo_get_fd_for_plane-at-runtime.patch to
fix startup failures on Xilinx (LP: #1987628)
-- Daniel van Vugt <email address hidden> Tue, 30 Aug 2022 09:54:16 +0000
-
xwayland (2:22.1.1-1ubuntu0.1) jammy-security; urgency=medium
* SECURITY UPDATE: ProcXkbSetGeometry Out-Of-Bounds Access
- debian/patches/CVE-2022-2319-pre1.patch: switch to array index loops
to moving pointers in xkb/xkb.c.
- debian/patches/CVE-2022-2319.patch: add request length validation for
XkbSetGeometry in xkb/xkb.c.
- CVE-2022-2319
* SECURITY UPDATE: ProcXkbSetDeviceInfo Out-Of-Bounds Access
- debian/patches/CVE-2022-2320.patch: swap XkbSetDeviceInfo and
XkbSetDeviceInfoCheck in xkb/xkb.c.
- CVE-2022-2320
-- Marc Deslauriers <email address hidden> Wed, 06 Jul 2022 10:36:22 -0400
-
xwayland (2:22.1.1-1) unstable; urgency=medium
* New upstream release.
-- Timo Aaltonen <email address hidden> Fri, 01 Apr 2022 09:40:47 +0300
-
xwayland (2:22.1.0-1) unstable; urgency=medium
* New upstream release.
* control: Bump policy to 4.6.0.
-- Timo Aaltonen <email address hidden> Wed, 16 Feb 2022 20:20:06 +0200
-
xwayland (2:22.0.99.902-1) unstable; urgency=medium
* New upstream release candidate.
* control: Add libxcvt-dev to build-depends.
-- Timo Aaltonen <email address hidden> Thu, 03 Feb 2022 12:56:33 +0200
-
xwayland (2:21.1.4-1) unstable; urgency=medium
* New upstream release.
* render: Fix out of bounds access in SProcRenderCompositeGlyphs()
[CVE-2021-4008]
* xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
[CVE-2021-4009]
* Xext: Fix out of bounds access in SProcScreenSaverSuspend()
[CVE-2021-4010]
* record: Fix out of bounds access in SwapCreateRegister()
[CVE-2021-4011]
-- Timo Aaltonen <email address hidden> Tue, 14 Dec 2021 16:19:18 +0200
-
xwayland (2:21.1.3-1ubuntu1) jammy; urgency=medium
* SECURITY UPDATE: SProcRenderCompositeGlyphs out-of-bounds access
- debian/patches/CVE-2021-4008.patch: check lengths in render/render.c.
- CVE-2021-4008
* SECURITY UPDATE: SProcXFixesCreatePointerBarrier out-of-bounds access
- debian/patches/CVE-2021-4009.patch: use sizes in xfixes/cursor.c.
- CVE-2021-4009
* SECURITY UPDATE: SProcScreenSaverSuspend out-of-bounds access
- debian/patches/CVE-2021-4010.patch: fix logic in Xext/saver.c.
- CVE-2021-4010
* SECURITY UPDATE: SwapCreateRegister out-of-bounds access
- debian/patches/CVE-2021-4011.patch: fix length in record/record.c.
- CVE-2021-4011
-- Marc Deslauriers <email address hidden> Tue, 14 Dec 2021 11:12:46 -0500
-
xwayland (2:21.1.3-1) unstable; urgency=medium
* Initial release. (Closes: #981841, #992146)
-- Timo Aaltonen <email address hidden> Mon, 08 Nov 2021 16:39:28 +0200
-
xwayland (2:21.1.2-0ubuntu1) impish; urgency=medium
* New upstream release.
-- Timo Aaltonen <email address hidden> Tue, 10 Aug 2021 12:17:36 +0300
