| Message ID | 20240125222140.1805844-1-peter@korsgaard.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/2] package/xwayland: security bump to version 23.2.4 | expand |
On 25/01/2024 23.21, Peter Korsgaard wrote: > Fixes the following security issues: > > 1) CVE-2023-6816 can be triggered by passing an invalid array index to > DeviceFocusEvent or ProcXIQueryPointer. > > 2) CVE-2024-0229 can be triggered if a device has both a button and a > key class and zero buttons. > > 3) CVE-2024-21885 can be triggered if a device with a given ID was > removed and a new device with the same ID added both in the same > operation. > > 4) CVE-2024-21886 can be triggered by disabling a master device with > disabled slave devices. > > 5) CVE-2024-0409 can be triggered by enabling SELinux > xserver_object_manager and running a client. > > 6) CVE-2024-0408 can be triggered by enabling SELinux > xserver_object_manager and creating a GLX PBuffer. > > For details, see the advisory: > https://lists.x.org/archives/xorg-announce/2024-January/003444.html > > Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Committed, thanks.
On 25/01/2024 23.21, Peter Korsgaard wrote: > Fixes the following security issues: > > 1) CVE-2023-6816 can be triggered by passing an invalid array index to > DeviceFocusEvent or ProcXIQueryPointer. > > 2) CVE-2024-0229 can be triggered if a device has both a button and a > key class and zero buttons. > > 3) CVE-2024-21885 can be triggered if a device with a given ID was > removed and a new device with the same ID added both in the same > operation. > > 4) CVE-2024-21886 can be triggered by disabling a master device with > disabled slave devices. > > 5) CVE-2024-0409 can be triggered by enabling SELinux > xserver_object_manager and running a client. > > 6) CVE-2024-0408 can be triggered by enabling SELinux > xserver_object_manager and creating a GLX PBuffer. > > For details, see the advisory: > https://lists.x.org/archives/xorg-announce/2024-January/003444.html > > Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Committed to 2023.02.x and 2023.11.x, thanks.
diff --git a/package/x11r7/xwayland/xwayland.hash b/package/x11r7/xwayland/xwayland.hash index 533ef9de86..5bb26bf17e 100644 --- a/package/x11r7/xwayland/xwayland.hash +++ b/package/x11r7/xwayland/xwayland.hash @@ -1,6 +1,6 @@ -# From https://lists.x.org/archives/xorg-announce/2023-December/003437.html -sha256 eb9d9aa7232c47412c8835ec15a97c575f03563726c787754ff0c019bd07e302 xwayland-23.2.3.tar.xz -sha512 37198aa2f06313a0cb2add51cc78f81b26a42f2c9d55a0d3eecf958777107ea5560961c128f2d0af055f7460ba10fadb1b9050251c2c50f2251b40ab517e79cd xwayland-23.2.3.tar.xz +# From https://lists.x.org/archives/xorg-announce/2024-January/003443.html +sha256 a99e159b6d0d33098b3b6ab22a88bfcece23c8b9d0ca72c535c55dcb0681b46b xwayland-23.2.4.tar.xz +sha512 ac3ff208cbef5bbe4637c335cfda226489c93b0a3768f2f4fb0201c588485ede38262fbce77ef1425b3d2a0be61b6580df53341c7b95e6072c8b6371ad29d187 xwayland-23.2.4.tar.xz # Locally calculated sha256 4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f COPYING diff --git a/package/x11r7/xwayland/xwayland.mk b/package/x11r7/xwayland/xwayland.mk index 8f4bcd8117..c66dd471ac 100644 --- a/package/x11r7/xwayland/xwayland.mk +++ b/package/x11r7/xwayland/xwayland.mk @@ -4,7 +4,7 @@ # ################################################################################ -XWAYLAND_VERSION = 23.2.3 +XWAYLAND_VERSION = 23.2.4 XWAYLAND_SOURCE = xwayland-$(XWAYLAND_VERSION).tar.xz XWAYLAND_SITE = https://xorg.freedesktop.org/archive/individual/xserver XWAYLAND_LICENSE = MIT
Fixes the following security issues: 1) CVE-2023-6816 can be triggered by passing an invalid array index to DeviceFocusEvent or ProcXIQueryPointer. 2) CVE-2024-0229 can be triggered if a device has both a button and a key class and zero buttons. 3) CVE-2024-21885 can be triggered if a device with a given ID was removed and a new device with the same ID added both in the same operation. 4) CVE-2024-21886 can be triggered by disabling a master device with disabled slave devices. 5) CVE-2024-0409 can be triggered by enabling SELinux xserver_object_manager and running a client. 6) CVE-2024-0408 can be triggered by enabling SELinux xserver_object_manager and creating a GLX PBuffer. For details, see the advisory: https://lists.x.org/archives/xorg-announce/2024-January/003444.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> --- package/x11r7/xwayland/xwayland.hash | 6 +++--- package/x11r7/xwayland/xwayland.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)