xwayland (2:22.1.1-1ubuntu0.13) jammy-security; urgency=medium * SECURITY REGRESSION: Avoid possible double-free - debian/patches/CVE-2024-31083-regression.patch: fix a regression caused for a double-free at the last changes fixed by CVE-2024-31083 (LP: #2060354) -- Leonidas Da Silva Barbosa Mon, 08 Apr 2024 22:13:22 -0300 xwayland (2:22.1.1-1ubuntu0.12) jammy-security; urgency=medium * SECURITY UPDATE: Heap buffer over read - debian/patches/CVE-2024-31080.patch: fixes byte swapping in replies in Xi/xiselectev.c. - CVE-2024-31080 * SECURITY UPDATE: Heap buffer over read - debian/patches/CVE-2024-31081.patch: fixes byte swapping in replies in Xi/xipassivegrab.c. - CVE-2024-31081 * SECURITY UPDATE: User-after-free - debian/patches/CVE-2024-31083.patch: fix recounting of glyphs during ProcRenderAddGlyphs in render/glyph.c. - CVE-2024-31083 -- Leonidas Da Silva Barbosa Tue, 02 Apr 2024 14:08:05 -0300 xwayland (2:22.1.1-1ubuntu0.11) jammy-security; urgency=medium * SECURITY REGRESSION: memory leak due to incomplete fix (LP: #2051536) - debian/patches/CVE-2024-21886-3.patch: fix use after free in input device shutdown in dix/devices.c. -- Marc Deslauriers Mon, 29 Jan 2024 07:51:17 -0500 xwayland (2:22.1.1-1ubuntu0.10) jammy-security; urgency=medium * SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer - debian/patches/CVE-2023-6816.patch: allocate enough space for logical button maps in Xi/xiquerypointer.c, dix/enterleave.c. - CVE-2023-6816 * SECURITY UPDATE: Reattaching to different master device may lead to out-of-bounds memory access - debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for our DeviceStateNotify in dix/enterleave.c. - debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event calculation in dix/enterleave.c. - debian/patches/CVE-2024-0229-3.patch: when creating a new ButtonClass, set the number of buttons in Xi/exevents.c. - debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard device for XIAttachToMaster in Xi/xichangehierarchy.c. - CVE-2024-0229 * SECURITY UPDATE: SELinux unlabeled GLX PBuffer - debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer in glx/glxcmds.c. - CVE-2024-0408 * SECURITY UPDATE: SELinux context corruption - debian/patches/CVE-2024-0409.patch: use the proper private key for cursor in hw/xwayland/xwayland-cursor.c. - CVE-2024-0409 * SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent - debian/patches/CVE-2024-21885.patch: flush hierarchy events after adding/removing master devices in Xi/xichangehierarchy.c. - CVE-2024-21885 * SECURITY UPDATE: Heap buffer overflow in DisableDevice - debian/patches/CVE-2024-21886-1.patch: do not keep linked list pointer during recursion in dix/devices.c. - debian/patches/CVE-2024-21886-2.patch: when disabling a master, float disabled slaved devices too in dix/devices.c. - CVE-2024-21886 -- Marc Deslauriers Mon, 15 Jan 2024 13:08:16 -0500 xwayland (2:22.1.1-1ubuntu0.9) jammy-security; urgency=medium * SECURITY UPDATE: Out-of-bounds memory write in XKB button actions - debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for our buttons in Xi/exevents.c, dix/devices.c. - CVE-2023-6377 * SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty - debian/patches/CVE-2023-6478.patch: avoid integer truncation in length check of ProcRRChange*Property in randr/rrproperty.c, randr/rrproviderproperty.c. - CVE-2023-6478 -- Marc Deslauriers Tue, 12 Dec 2023 20:32:35 -0500 xwayland (2:22.1.1-1ubuntu0.7) jammy-security; urgency=medium * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and RRChangeOutputProperty - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c. - CVE-2023-5367 -- Marc Deslauriers Mon, 16 Oct 2023 09:20:53 -0400 xwayland (2:22.1.1-1ubuntu0.6) jammy-security; urgency=medium * SECURITY UPDATE: Overlay Window Use-After-Free - debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in composite/compwindow.c. - CVE-2023-1393 -- Marc Deslauriers Wed, 29 Mar 2023 09:05:35 -0400 xwayland (2:22.1.1-1ubuntu0.5) jammy-security; urgency=medium * SECURITY UPDATE: DeepCopyPointerClasses use-after-free - debian/patches/CVE-2023-0494.patch: fix potential use-after-free in Xi/exevents.c. - CVE-2023-0494 -- Marc Deslauriers Tue, 07 Feb 2023 08:06:17 -0500 xwayland (2:22.1.1-1ubuntu0.4) jammy-security; urgency=medium * SECURITY UPDATE: XTestSwapFakeInput stack overflow - debian/patches/CVE-2022-46340.patch: disallow GenericEvents in XTestSwapFakeInput in Xext/xtest.c. - CVE-2022-46340 * SECURITY UPDATE: XIPassiveUngrabDevice out-of-bounds access - debian/patches/CVE-2022-46341.patch: disallow passive grabs with a detail > 255 in Xi/xipassivegrab.c. - CVE-2022-46341 * SECURITY UPDATE: XvdiSelectVideoNotify use-after-free - debian/patches/CVE-2022-46342.patch: free the XvRTVideoNotify when turning off from the same client in Xext/xvmain.c. - CVE-2022-46342 * SECURITY UPDATE: ScreenSaverSetAttributes use-after-free - debian/patches/CVE-2022-46343.patch: free the screen saver resource when replacing it in Xext/saver.c. - CVE-2022-46343 * SECURITY UPDATE: XIChangeProperty out-of-bounds access - debian/patches/CVE-2022-46344-1.patch: return an error from XI property changes if verification failed in Xi/xiproperty.c. - debian/patches/CVE-2022-46344-2.patch: avoid integer truncation in length check of ProcXIChangeProperty in Xi/xiproperty.c. - CVE-2022-46344 * SECURITY UPDATE: XkbGetKbdByName use-after-free - debian/patches/CVE-2022-4283.patch: reset the radio_groups pointer to NULL after freeing it in xkb/xkbUtils.c. - CVE-2022-4283 -- Marc Deslauriers Wed, 07 Dec 2022 09:12:14 -0500 xwayland (2:22.1.1-1ubuntu0.3) jammy-security; urgency=medium * SECURITY UPDATE: GetCountedString Buffer Overflow - debian/patches/CVE-2022-3550.patch: add a check for client->req_len size for _GetCountedString in xkb/xkb.c. - CVE-2022-3550 * SECURITY UPDATE: ProcXkbGetKbdByName Memory Leak - debian/patches/CVE-2022-3551.patch: add calls to free allocated memory if the execution reaches failures in ProcXkbGetKbdByName in xkb/xkb.c. - CVE-2022-3551 -- Rodrigo Figueiredo Zaiden Tue, 22 Nov 2022 16:24:55 -0300 xwayland (2:22.1.1-1ubuntu0.2) jammy; urgency=medium * Add xwayland-Detect-gbm_bo_get_fd_for_plane-at-runtime.patch to fix startup failures on Xilinx (LP: #1987628) -- Daniel van Vugt Tue, 30 Aug 2022 09:54:16 +0000 xwayland (2:22.1.1-1ubuntu0.1) jammy-security; urgency=medium * SECURITY UPDATE: ProcXkbSetGeometry Out-Of-Bounds Access - debian/patches/CVE-2022-2319-pre1.patch: switch to array index loops to moving pointers in xkb/xkb.c. - debian/patches/CVE-2022-2319.patch: add request length validation for XkbSetGeometry in xkb/xkb.c. - CVE-2022-2319 * SECURITY UPDATE: ProcXkbSetDeviceInfo Out-Of-Bounds Access - debian/patches/CVE-2022-2320.patch: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck in xkb/xkb.c. - CVE-2022-2320 -- Marc Deslauriers Wed, 06 Jul 2022 10:36:22 -0400 xwayland (2:22.1.1-1) unstable; urgency=medium * New upstream release. -- Timo Aaltonen Fri, 01 Apr 2022 09:40:47 +0300 xwayland (2:22.1.0-1) unstable; urgency=medium * New upstream release. * control: Bump policy to 4.6.0. -- Timo Aaltonen Wed, 16 Feb 2022 20:20:06 +0200 xwayland (2:22.0.99.902-1) unstable; urgency=medium * New upstream release candidate. * control: Add libxcvt-dev to build-depends. -- Timo Aaltonen Thu, 03 Feb 2022 12:56:33 +0200 xwayland (2:21.1.4-1) unstable; urgency=medium * New upstream release. * render: Fix out of bounds access in SProcRenderCompositeGlyphs() [CVE-2021-4008] * xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() [CVE-2021-4009] * Xext: Fix out of bounds access in SProcScreenSaverSuspend() [CVE-2021-4010] * record: Fix out of bounds access in SwapCreateRegister() [CVE-2021-4011] -- Timo Aaltonen Tue, 14 Dec 2021 16:19:18 +0200 xwayland (2:21.1.3-1) unstable; urgency=medium * Initial release. (Closes: #981841, #992146) -- Timo Aaltonen Mon, 08 Nov 2021 16:39:28 +0200