xwayland (2:22.1.1-1ubuntu0.20) jammy-security; urgency=medium

  * SECURITY UPDATE: Use-after-free in XPresentNotify structures creation
    - debian/patches/CVE-2025-62229.patch: fix use-after-free in
      present/present_notify.c.
    - CVE-2025-62229
  * SECURITY UPDATE: Use-after-free in Xkb client resource removal
    - debian/patches/CVE-2025-62230-1.patch: make the RT_XKBCLIENT resource
      private in xkb/xkb.c, include/xkbsrv.h.
    - debian/patches/CVE-2025-62230-2.patch: free the XKB resource when
      freeing XkbInterest in xkb/xkbEvents.c.
    - CVE-2025-62230
  * SECURITY UPDATE: Value overflow in Xkb extension XkbSetCompatMap()
    - debian/patches/CVE-2025-62231.patch: prevent overflow in xkb/xkb.c.
    - CVE-2025-62231

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Oct 2025 14:30:43 -0400

xwayland (2:22.1.1-1ubuntu0.19) jammy-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds access in X Rendering extension
    - debian/patches/CVE-2025-49175.patch: avoid 0 or less animated cursors
      in render/animcur.c, render/render.c.
    - CVE-2025-49175
  * SECURITY UPDATE: Integer overflow in Big Requests Extension
    - debian/patches/CVE-2025-49176.patch: do not overflow the integer size
      with BigRequest in dix/dispatch.c, os/io.c.
    - CVE-2025-49176
  * SECURITY UPDATE: Data leak in XFIXES Extension 6
    - debian/patches/CVE-2025-49177.patch: check request length for
      SetClientDisconnectMode in xfixes/disconnect.c.
    - CVE-2025-49177
  * SECURITY UPDATE: Unprocessed client request via bytes to ignore
    - debian/patches/CVE-2025-49178.patch: account for bytes to ignore when
      sharing input buffer in os/io.c.
    - CVE-2025-49178
  * SECURITY UPDATE: Integer overflow in X Record extension
    - debian/patches/CVE-2025-49179.patch: check for overflow in
      RecordSanityCheckRegisterClients() in record/record.c.
    - CVE-2025-49179
  * SECURITY UPDATE: Integer overflow in RandR extension
    - debian/patches/CVE-2025-49180-1.patch: check for overflow in
      RRChangeProviderProperty() in randr/rrproviderproperty.c.
    - CVE-2025-49180

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 11 Jun 2025 09:02:41 -0400

xwayland (2:22.1.1-1ubuntu0.18) jammy; urgency=medium

  * Backport patches to avoid crash after the busy-loop fix (LP: 2043517).
    With the busy-loop fixed, XWayland can now proceed further and may
    encounter a new crash (LP: #2096653).
    - xwayland-glamor-cleanup-xwl_gbm-only-once.patch
    - xwayland-glamor-disable-after-gbm-cleanup.patch

 -- Alessandro Astone <alessandro.astone@canonical.com>  Wed, 26 Mar 2025 12:24:28 +0100

xwayland (2:22.1.1-1ubuntu0.17) jammy-security; urgency=medium

  * SECURITY UPDATE: Use-after-free of the root cursor
    - debian/patches/CVE-2025-26594-1.patch: refuse to free the root cursor
      in dix/dispatch.c.
    - debian/patches/CVE-2025-26594-2.patch: keep a ref to the rootCursor
      in dix/main.c.
    - CVE-2025-26594
  * SECURITY UPDATE: Buffer overflow in XkbVModMaskText()
    - debian/patches/CVE-2025-26595.patch: fix bounds check in
      xkb/xkbtext.c.
    - CVE-2025-26595
  * SECURITY UPDATE: Heap overflow in XkbWriteKeySyms()
    - debian/patches/CVE-2025-26596.patch: fix computation of
      XkbSizeKeySyms in xkb/xkb.c.
    - CVE-2025-26596
  * SECURITY UPDATE: Buffer overflow in XkbChangeTypesOfKey()
    - debian/patches/CVE-2025-26597.patch: also resize key actions in
      xkb/XKBMisc.c.
    - CVE-2025-26597
  * SECURITY UPDATE: Out-of-bounds write in CreatePointerBarrierClient()
    - debian/patches/CVE-2025-26598.patch: fix barrier device search in
      Xi/xibarriers.c.
    - CVE-2025-26598
  * SECURITY UPDATE: Use of uninitialized pointer in compRedirectWindow()
    - debian/patches/CVE-2025-26599-1.patch: handle failure to redirect in
      composite/compalloc.c.
    - debian/patches/CVE-2025-26599-2.patch: initialize border clip even
      when pixmap alloc fails in composite/compalloc.c.
    - CVE-2025-26599
  * SECURITY UPDATE: Use-after-free in PlayReleasedEvents()
    - debian/patches/CVE-2025-26600.patch: dequeue pending events on frozen
      device on removal in dix/devices.c.
    - CVE-2025-26600
  * SECURITY UPDATE: Use-after-free in SyncInitTrigger()
    - debian/patches/CVE-2025-26601-1.patch: do not let sync objects
      uninitialized in Xext/sync.c.
    - debian/patches/CVE-2025-26601-2.patch: check values before applying
      changes in Xext/sync.c.
    - debian/patches/CVE-2025-26601-3.patch: do not fail
      SyncAddTriggerToSyncObject() in Xext/sync.c.
    - debian/patches/CVE-2025-26601-4.patch: apply changes last in
      SyncChangeAlarmAttributes() in Xext/sync.c.
    - CVE-2025-26601
  * Note: this package does _not_ contain the changes from
    (2:22.1.1-1ubuntu0.16) in jammy-proposed.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Feb 2025 10:05:45 -0500

xwayland (2:22.1.1-1ubuntu0.15) jammy; urgency=medium

  * Backport patch to fix busy-loop on inactive VT (LP: #2043517)

 -- Alessandro Astone <alessandro.astone@canonical.com>  Fri, 22 Nov 2024 17:09:02 +0100

xwayland (2:22.1.1-1ubuntu0.14) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer overflow in _XkbSetCompatMap
    - debian/patches/CVE-2024-9632.patch: properly update size in
      xkb/xkb.c.
    - CVE-2024-9632

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 11 Oct 2024 10:40:32 -0400

xwayland (2:22.1.1-1ubuntu0.13) jammy-security; urgency=medium

  * SECURITY REGRESSION: Avoid possible double-free
    - debian/patches/CVE-2024-31083-regression.patch:
      fix a regression caused for a double-free at the last
      changes fixed by CVE-2024-31083 (LP: #2060354)

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 08 Apr 2024 22:13:22 -0300

xwayland (2:22.1.1-1ubuntu0.12) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31080.patch: fixes byte
      swapping in replies in Xi/xiselectev.c.
    - CVE-2024-31080
  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31081.patch: fixes byte
      swapping in replies in Xi/xipassivegrab.c.
    - CVE-2024-31081
  * SECURITY UPDATE: User-after-free
    - debian/patches/CVE-2024-31083.patch: fix recounting of glyphs
      during ProcRenderAddGlyphs in render/glyph.c.
    - CVE-2024-31083

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Tue, 02 Apr 2024 14:08:05 -0300

xwayland (2:22.1.1-1ubuntu0.11) jammy-security; urgency=medium

  * SECURITY REGRESSION: memory leak due to incomplete fix (LP: #2051536)
    - debian/patches/CVE-2024-21886-3.patch: fix use after free in input
      device shutdown in dix/devices.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 29 Jan 2024 07:51:17 -0500

xwayland (2:22.1.1-1ubuntu0.10) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
    ProcXIQueryPointer
    - debian/patches/CVE-2023-6816.patch: allocate enough space for logical
      button maps in Xi/xiquerypointer.c, dix/enterleave.c.
    - CVE-2023-6816
  * SECURITY UPDATE: Reattaching to different master device may lead to
    out-of-bounds memory access
    - debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
      our DeviceStateNotify in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
      calculation in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-3.patch: when creating a new
      ButtonClass, set the number of buttons in Xi/exevents.c.
    - debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
      device for XIAttachToMaster in Xi/xichangehierarchy.c.
    - CVE-2024-0229
  * SECURITY UPDATE: SELinux unlabeled GLX PBuffer
    - debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
      in glx/glxcmds.c.
    - CVE-2024-0408
  * SECURITY UPDATE: SELinux context corruption
    - debian/patches/CVE-2024-0409.patch: use the proper private key for
      cursor in hw/xwayland/xwayland-cursor.c.
    - CVE-2024-0409
  * SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
    - debian/patches/CVE-2024-21885.patch: flush hierarchy events after
      adding/removing master devices in Xi/xichangehierarchy.c.
    - CVE-2024-21885
  * SECURITY UPDATE: Heap buffer overflow in DisableDevice
    - debian/patches/CVE-2024-21886-1.patch: do not keep linked list
      pointer during recursion in dix/devices.c.
    - debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
      disabled slaved devices too in dix/devices.c.
    - CVE-2024-21886

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 15 Jan 2024 13:08:16 -0500

xwayland (2:22.1.1-1ubuntu0.9) jammy-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds memory write in XKB button actions
    - debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for
      our buttons in Xi/exevents.c, dix/devices.c.
    - CVE-2023-6377
  * SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty
    and RRChangeProviderProperty
    - debian/patches/CVE-2023-6478.patch: avoid integer truncation in
      length check of ProcRRChange*Property in randr/rrproperty.c,
      randr/rrproviderproperty.c.
    - CVE-2023-6478

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 12 Dec 2023 20:32:35 -0500

xwayland (2:22.1.1-1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
    RRChangeOutputProperty
    - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
      and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
    - CVE-2023-5367

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 16 Oct 2023 09:20:53 -0400

xwayland (2:22.1.1-1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Overlay Window Use-After-Free
    - debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in
      composite/compwindow.c.
    - CVE-2023-1393

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Mar 2023 09:05:35 -0400

xwayland (2:22.1.1-1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: DeepCopyPointerClasses use-after-free
    - debian/patches/CVE-2023-0494.patch: fix potential use-after-free in
      Xi/exevents.c.
    - CVE-2023-0494

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Feb 2023 08:06:17 -0500

xwayland (2:22.1.1-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: XTestSwapFakeInput stack overflow
    - debian/patches/CVE-2022-46340.patch: disallow GenericEvents in
      XTestSwapFakeInput in Xext/xtest.c.
    - CVE-2022-46340
  * SECURITY UPDATE: XIPassiveUngrabDevice out-of-bounds access
    - debian/patches/CVE-2022-46341.patch: disallow passive grabs with a
      detail > 255 in Xi/xipassivegrab.c.
    - CVE-2022-46341
  * SECURITY UPDATE: XvdiSelectVideoNotify use-after-free
    - debian/patches/CVE-2022-46342.patch: free the XvRTVideoNotify when
      turning off from the same client in Xext/xvmain.c.
    - CVE-2022-46342
  * SECURITY UPDATE: ScreenSaverSetAttributes use-after-free
    - debian/patches/CVE-2022-46343.patch: free the screen saver resource
      when replacing it in Xext/saver.c.
    - CVE-2022-46343
  * SECURITY UPDATE: XIChangeProperty out-of-bounds access
    - debian/patches/CVE-2022-46344-1.patch: return an error from XI
      property changes if verification failed in Xi/xiproperty.c.
    - debian/patches/CVE-2022-46344-2.patch: avoid integer truncation in
      length check of ProcXIChangeProperty in Xi/xiproperty.c.
    - CVE-2022-46344
  * SECURITY UPDATE: XkbGetKbdByName use-after-free
    - debian/patches/CVE-2022-4283.patch: reset the radio_groups pointer to
      NULL after freeing it in xkb/xkbUtils.c.
    - CVE-2022-4283

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 07 Dec 2022 09:12:14 -0500

xwayland (2:22.1.1-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: GetCountedString Buffer Overflow
    - debian/patches/CVE-2022-3550.patch: add a check for client->req_len
      size for _GetCountedString in xkb/xkb.c.
    - CVE-2022-3550
  * SECURITY UPDATE: ProcXkbGetKbdByName Memory Leak
    - debian/patches/CVE-2022-3551.patch: add calls to free allocated
      memory if the execution reaches failures in ProcXkbGetKbdByName
      in xkb/xkb.c.
    - CVE-2022-3551

 -- Rodrigo Figueiredo Zaiden <rodrigo.zaiden@canonical.com>  Tue, 22 Nov 2022 16:24:55 -0300

xwayland (2:22.1.1-1ubuntu0.2) jammy; urgency=medium

  * Add xwayland-Detect-gbm_bo_get_fd_for_plane-at-runtime.patch to
    fix startup failures on Xilinx (LP: #1987628)

 -- Daniel van Vugt <daniel.van.vugt@canonical.com>  Tue, 30 Aug 2022 09:54:16 +0000

xwayland (2:22.1.1-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: ProcXkbSetGeometry Out-Of-Bounds Access
    - debian/patches/CVE-2022-2319-pre1.patch: switch to array index loops
      to moving pointers in xkb/xkb.c.
    - debian/patches/CVE-2022-2319.patch: add request length validation for
      XkbSetGeometry in xkb/xkb.c.
    - CVE-2022-2319
  * SECURITY UPDATE: ProcXkbSetDeviceInfo Out-Of-Bounds Access
    - debian/patches/CVE-2022-2320.patch: swap XkbSetDeviceInfo and
      XkbSetDeviceInfoCheck in xkb/xkb.c.
    - CVE-2022-2320

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 06 Jul 2022 10:36:22 -0400

xwayland (2:22.1.1-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 01 Apr 2022 09:40:47 +0300

xwayland (2:22.1.0-1) unstable; urgency=medium

  * New upstream release.
  * control: Bump policy to 4.6.0.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Feb 2022 20:20:06 +0200

xwayland (2:22.0.99.902-1) unstable; urgency=medium

  * New upstream release candidate.
  * control: Add libxcvt-dev to build-depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 03 Feb 2022 12:56:33 +0200

xwayland (2:21.1.4-1) unstable; urgency=medium

  * New upstream release.
  * render: Fix out of bounds access in SProcRenderCompositeGlyphs()
    [CVE-2021-4008]
  * xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
    [CVE-2021-4009]
  * Xext: Fix out of bounds access in SProcScreenSaverSuspend()
    [CVE-2021-4010]
  * record: Fix out of bounds access in SwapCreateRegister()
    [CVE-2021-4011]

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Dec 2021 16:19:18 +0200

xwayland (2:21.1.3-1) unstable; urgency=medium

  * Initial release. (Closes: #981841, #992146)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 08 Nov 2021 16:39:28 +0200
