xwayland (2:22.1.1-1ubuntu0.19) jammy-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds access in X Rendering extension
- debian/patches/CVE-2025-49175.patch: avoid 0 or less animated cursors
in render/animcur.c, render/render.c.
- CVE-2025-49175
* SECURITY UPDATE: Integer overflow in Big Requests Extension
- debian/patches/CVE-2025-49176.patch: do not overflow the integer size
with BigRequest in dix/dispatch.c, os/io.c.
- CVE-2025-49176
* SECURITY UPDATE: Data leak in XFIXES Extension 6
- debian/patches/CVE-2025-49177.patch: check request length for
SetClientDisconnectMode in xfixes/disconnect.c.
- CVE-2025-49177
* SECURITY UPDATE: Unprocessed client request via bytes to ignore
- debian/patches/CVE-2025-49178.patch: account for bytes to ignore when
sharing input buffer in os/io.c.
- CVE-2025-49178
* SECURITY UPDATE: Integer overflow in X Record extension
- debian/patches/CVE-2025-49179.patch: check for overflow in
RecordSanityCheckRegisterClients() in record/record.c.
- CVE-2025-49179
* SECURITY UPDATE: Integer overflow in RandR extension
- debian/patches/CVE-2025-49180-1.patch: check for overflow in
RRChangeProviderProperty() in randr/rrproviderproperty.c.
- CVE-2025-49180
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 11 Jun 2025 09:02:41 -0400
xwayland (2:22.1.1-1ubuntu0.18) jammy; urgency=medium
* Backport patches to avoid crash after the busy-loop fix (LP: 2043517).
With the busy-loop fixed, XWayland can now proceed further and may
encounter a new crash (LP: #2096653).
- xwayland-glamor-cleanup-xwl_gbm-only-once.patch
- xwayland-glamor-disable-after-gbm-cleanup.patch
-- Alessandro Astone <alessandro.astone@canonical.com> Wed, 26 Mar 2025 12:24:28 +0100
xwayland (2:22.1.1-1ubuntu0.17) jammy-security; urgency=medium
* SECURITY UPDATE: Use-after-free of the root cursor
- debian/patches/CVE-2025-26594-1.patch: refuse to free the root cursor
in dix/dispatch.c.
- debian/patches/CVE-2025-26594-2.patch: keep a ref to the rootCursor
in dix/main.c.
- CVE-2025-26594
* SECURITY UPDATE: Buffer overflow in XkbVModMaskText()
- debian/patches/CVE-2025-26595.patch: fix bounds check in
xkb/xkbtext.c.
- CVE-2025-26595
* SECURITY UPDATE: Heap overflow in XkbWriteKeySyms()
- debian/patches/CVE-2025-26596.patch: fix computation of
XkbSizeKeySyms in xkb/xkb.c.
- CVE-2025-26596
* SECURITY UPDATE: Buffer overflow in XkbChangeTypesOfKey()
- debian/patches/CVE-2025-26597.patch: also resize key actions in
xkb/XKBMisc.c.
- CVE-2025-26597
* SECURITY UPDATE: Out-of-bounds write in CreatePointerBarrierClient()
- debian/patches/CVE-2025-26598.patch: fix barrier device search in
Xi/xibarriers.c.
- CVE-2025-26598
* SECURITY UPDATE: Use of uninitialized pointer in compRedirectWindow()
- debian/patches/CVE-2025-26599-1.patch: handle failure to redirect in
composite/compalloc.c.
- debian/patches/CVE-2025-26599-2.patch: initialize border clip even
when pixmap alloc fails in composite/compalloc.c.
- CVE-2025-26599
* SECURITY UPDATE: Use-after-free in PlayReleasedEvents()
- debian/patches/CVE-2025-26600.patch: dequeue pending events on frozen
device on removal in dix/devices.c.
- CVE-2025-26600
* SECURITY UPDATE: Use-after-free in SyncInitTrigger()
- debian/patches/CVE-2025-26601-1.patch: do not let sync objects
uninitialized in Xext/sync.c.
- debian/patches/CVE-2025-26601-2.patch: check values before applying
changes in Xext/sync.c.
- debian/patches/CVE-2025-26601-3.patch: do not fail
SyncAddTriggerToSyncObject() in Xext/sync.c.
- debian/patches/CVE-2025-26601-4.patch: apply changes last in
SyncChangeAlarmAttributes() in Xext/sync.c.
- CVE-2025-26601
* Note: this package does _not_ contain the changes from
(2:22.1.1-1ubuntu0.16) in jammy-proposed.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 19 Feb 2025 10:05:45 -0500
xwayland (2:22.1.1-1ubuntu0.15) jammy; urgency=medium
* Backport patch to fix busy-loop on inactive VT (LP: #2043517)
-- Alessandro Astone <alessandro.astone@canonical.com> Fri, 22 Nov 2024 17:09:02 +0100
xwayland (2:22.1.1-1ubuntu0.14) jammy-security; urgency=medium
* SECURITY UPDATE: Heap-based buffer overflow in _XkbSetCompatMap
- debian/patches/CVE-2024-9632.patch: properly update size in
xkb/xkb.c.
- CVE-2024-9632
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 11 Oct 2024 10:40:32 -0400
xwayland (2:22.1.1-1ubuntu0.13) jammy-security; urgency=medium
* SECURITY REGRESSION: Avoid possible double-free
- debian/patches/CVE-2024-31083-regression.patch:
fix a regression caused for a double-free at the last
changes fixed by CVE-2024-31083 (LP: #2060354)
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Mon, 08 Apr 2024 22:13:22 -0300
xwayland (2:22.1.1-1ubuntu0.12) jammy-security; urgency=medium
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31080.patch: fixes byte
swapping in replies in Xi/xiselectev.c.
- CVE-2024-31080
* SECURITY UPDATE: Heap buffer over read
- debian/patches/CVE-2024-31081.patch: fixes byte
swapping in replies in Xi/xipassivegrab.c.
- CVE-2024-31081
* SECURITY UPDATE: User-after-free
- debian/patches/CVE-2024-31083.patch: fix recounting of glyphs
during ProcRenderAddGlyphs in render/glyph.c.
- CVE-2024-31083
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Tue, 02 Apr 2024 14:08:05 -0300
xwayland (2:22.1.1-1ubuntu0.11) jammy-security; urgency=medium
* SECURITY REGRESSION: memory leak due to incomplete fix (LP: #2051536)
- debian/patches/CVE-2024-21886-3.patch: fix use after free in input
device shutdown in dix/devices.c.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 29 Jan 2024 07:51:17 -0500
xwayland (2:22.1.1-1ubuntu0.10) jammy-security; urgency=medium
* SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
ProcXIQueryPointer
- debian/patches/CVE-2023-6816.patch: allocate enough space for logical
button maps in Xi/xiquerypointer.c, dix/enterleave.c.
- CVE-2023-6816
* SECURITY UPDATE: Reattaching to different master device may lead to
out-of-bounds memory access
- debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
our DeviceStateNotify in dix/enterleave.c.
- debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
calculation in dix/enterleave.c.
- debian/patches/CVE-2024-0229-3.patch: when creating a new
ButtonClass, set the number of buttons in Xi/exevents.c.
- debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
device for XIAttachToMaster in Xi/xichangehierarchy.c.
- CVE-2024-0229
* SECURITY UPDATE: SELinux unlabeled GLX PBuffer
- debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
in glx/glxcmds.c.
- CVE-2024-0408
* SECURITY UPDATE: SELinux context corruption
- debian/patches/CVE-2024-0409.patch: use the proper private key for
cursor in hw/xwayland/xwayland-cursor.c.
- CVE-2024-0409
* SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
- debian/patches/CVE-2024-21885.patch: flush hierarchy events after
adding/removing master devices in Xi/xichangehierarchy.c.
- CVE-2024-21885
* SECURITY UPDATE: Heap buffer overflow in DisableDevice
- debian/patches/CVE-2024-21886-1.patch: do not keep linked list
pointer during recursion in dix/devices.c.
- debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
disabled slaved devices too in dix/devices.c.
- CVE-2024-21886
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 15 Jan 2024 13:08:16 -0500
xwayland (2:22.1.1-1ubuntu0.9) jammy-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds memory write in XKB button actions
- debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for
our buttons in Xi/exevents.c, dix/devices.c.
- CVE-2023-6377
* SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty
and RRChangeProviderProperty
- debian/patches/CVE-2023-6478.patch: avoid integer truncation in
length check of ProcRRChange*Property in randr/rrproperty.c,
randr/rrproviderproperty.c.
- CVE-2023-6478
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 12 Dec 2023 20:32:35 -0500
# For older changelog entries, run 'apt-get changelog xwayland'
Generated by dwww version 1.14 on Sat Sep 6 03:01:41 CEST 2025.