Ubuntu
xwayland package

xwayland 2:23.2.0-1ubuntu0.4 source package in Ubuntu

Changelog

xwayland (2:23.2.0-1ubuntu0.4) mantic-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
    ProcXIQueryPointer
    - debian/patches/CVE-2023-6816.patch: allocate enough space for logical
      button maps in Xi/xiquerypointer.c, dix/enterleave.c.
    - CVE-2023-6816
  * SECURITY UPDATE: Reattaching to different master device may lead to
    out-of-bounds memory access
    - debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
      our DeviceStateNotify in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
      calculation in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-3.patch: when creating a new
      ButtonClass, set the number of buttons in Xi/exevents.c.
    - debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
      device for XIAttachToMaster in Xi/xichangehierarchy.c.
    - CVE-2024-0229
  * SECURITY UPDATE: SELinux unlabeled GLX PBuffer
    - debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
      in glx/glxcmds.c.
    - CVE-2024-0408
  * SECURITY UPDATE: SELinux context corruption
    - debian/patches/CVE-2024-0409.patch: use the proper private key for
      cursor in hw/xwayland/xwayland-cursor.c.
    - CVE-2024-0409
  * SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
    - debian/patches/CVE-2024-21885.patch: flush hierarchy events after
      adding/removing master devices in Xi/xichangehierarchy.c.
    - CVE-2024-21885
  * SECURITY UPDATE: Heap buffer overflow in DisableDevice
    - debian/patches/CVE-2024-21886-1.patch: do not keep linked list
      pointer during recursion in dix/devices.c.
    - debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
      disabled slaved devices too in dix/devices.c.
    - CVE-2024-21886

 -- Marc Deslauriers <email address hidden>  Mon, 15 Jan 2024 13:03:30 -0500

Upload details

Uploaded by:
Marc Deslauriers
Uploaded to:
Mantic
Original maintainer:
Ubuntu Developers
Architectures:
linux-any
Section:
x11
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
xwayland_23.2.0.orig.tar.xz 1.2 MiB 7f33ec2a34de6e66ae1b7e44872c3a2146192872c719b9acf192814edbabd4c5
xwayland_23.2.0.orig.tar.xz.asc 195 bytes f3304b58d34e289c5f5fef2296fc3afa8604ee7f385c4ad3f161b6d2346ae21d
xwayland_23.2.0-1ubuntu0.4.debian.tar.xz 44.5 KiB f7c34cba781c625e7edd9723687b724e245a1dbbf9a21ad50554beb441e8c8b3
xwayland_23.2.0-1ubuntu0.4.dsc 2.6 KiB d8e275a3921abb13f4d18333ccb4dbfd6e94f47a315632f8bca47b0ea123f616

View changes file

Binary packages built by this source

xwayland: X server for running X clients under Wayland

 This package provides an X server running on top of wayland, using wayland
 input devices for input and forwarding either the root window or individual
 top-level windows as wayland surfaces.

xwayland-dbgsym: debug symbols for xwayland