xorg-server (2:1.20.13-1ubuntu1~20.04.20) focal; urgency=medium

  * If a client application has not called DRI2ScreenInit(), 
    DRI2Authenticate() and DRI2CreateDrawable2() cause the X server to
    crash. This patch adds some sanity checks to ensure the X server
    stays running. (LP: #1861609)
    - d/p/lp1861609-dri2-Protect-against-dri2ClientPrivate-assertio.patch

 -- Matthew Ruffell <matthew.ruffell@canonical.com>  Tue, 04 Mar 2025 18:35:23 +1300

xorg-server (2:1.20.13-1ubuntu1~20.04.19) focal-security; urgency=medium

  * SECURITY UPDATE: Use-after-free of the root cursor
    - debian/patches/CVE-2025-26594-1.patch: refuse to free the root cursor
      in dix/dispatch.c.
    - debian/patches/CVE-2025-26594-2.patch: keep a ref to the rootCursor
      in dix/main.c.
    - CVE-2025-26594
  * SECURITY UPDATE: Buffer overflow in XkbVModMaskText()
    - debian/patches/CVE-2025-26595.patch: fix bounds check in
      xkb/xkbtext.c.
    - CVE-2025-26595
  * SECURITY UPDATE: Heap overflow in XkbWriteKeySyms()
    - debian/patches/CVE-2025-26596.patch: fix computation of
      XkbSizeKeySyms in xkb/xkb.c.
    - CVE-2025-26596
  * SECURITY UPDATE: Buffer overflow in XkbChangeTypesOfKey()
    - debian/patches/CVE-2025-26597.patch: also resize key actions in
      xkb/XKBMisc.c.
    - CVE-2025-26597
  * SECURITY UPDATE: Out-of-bounds write in CreatePointerBarrierClient()
    - debian/patches/CVE-2025-26598.patch: fix barrier device search in
      Xi/xibarriers.c.
    - CVE-2025-26598
  * SECURITY UPDATE: Use of uninitialized pointer in compRedirectWindow()
    - debian/patches/CVE-2025-26599-1.patch: handle failure to redirect in
      composite/compalloc.c.
    - debian/patches/CVE-2025-26599-2.patch: initialize border clip even
      when pixmap alloc fails in composite/compalloc.c.
    - CVE-2025-26599
  * SECURITY UPDATE: Use-after-free in PlayReleasedEvents()
    - debian/patches/CVE-2025-26600.patch: dequeue pending events on frozen
      device on removal in dix/devices.c.
    - CVE-2025-26600
  * SECURITY UPDATE: Use-after-free in SyncInitTrigger()
    - debian/patches/CVE-2025-26601-1.patch: do not let sync objects
      uninitialized in Xext/sync.c.
    - debian/patches/CVE-2025-26601-2.patch: check values before applying
      changes in Xext/sync.c.
    - debian/patches/CVE-2025-26601-3.patch: do not fail
      SyncAddTriggerToSyncObject() in Xext/sync.c.
    - debian/patches/CVE-2025-26601-4.patch: apply changes last in
      SyncChangeAlarmAttributes() in Xext/sync.c.
    - CVE-2025-26601

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Feb 2025 08:54:27 -0500

xorg-server (2:1.20.13-1ubuntu1~20.04.18) focal-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer overflow in _XkbSetCompatMap
    - debian/patches/CVE-2024-9632.patch: properly update size in
      xkb/xkb.c.
    - CVE-2024-9632

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 11 Oct 2024 10:23:55 -0400

xorg-server (2:1.20.13-1ubuntu1~20.04.17) focal-security; urgency=medium

  * SECURITY REGRESSION: Avoid possible double-free
    - debian/patches/CVE-2024-31083-regression.patch:
      fix a regression caused for a double-free at the last
      changes fixed by CVE-2024-31083 (LP: #2060354)

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 08 Apr 2024 22:36:10 -0300

xorg-server (2:1.20.13-1ubuntu1~20.04.16) focal-security; urgency=medium

  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31080.patch: fixes byte
      swapping in replies in Xi/xiselectev.c.
    - CVE-2024-31080
  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31081.patch: fixes byte
      swapping in replies in Xi/xipassivegrab.c.
    - CVE-2024-31081
  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31082.patch: makes
      ProcAppleDRICreatePixmap use unswapped length to
      send reply in hw/xquartz/xpr/appledir.c.
    - CVE-2024-31082
  * SECURITY UPDATE: User-after-free
    - debian/patches/CVE-2024-31083.patch: fix recounting of glyphs
      during ProcRenderAddGlyphs in render/glyph.c.
    - CVE-2024-31083

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 01 Apr 2024 17:17:12 -0300

xorg-server (2:1.20.13-1ubuntu1~20.04.15) focal-security; urgency=medium

  * SECURITY REGRESSION: memory leak due to incomplete fix (LP: #2051536)
    - debian/patches/CVE-2024-21886-3.patch: fix use after free in input
      device shutdown in dix/devices.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 29 Jan 2024 07:44:21 -0500

xorg-server (2:1.20.13-1ubuntu1~20.04.14) focal-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
    ProcXIQueryPointer
    - debian/patches/CVE-2023-6816.patch: allocate enough space for logical
      button maps in Xi/xiquerypointer.c, dix/enterleave.c.
    - CVE-2023-6816
  * SECURITY UPDATE: Reattaching to different master device may lead to
    out-of-bounds memory access
    - debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
      our DeviceStateNotify in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
      calculation in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-3.patch: when creating a new
      ButtonClass, set the number of buttons in Xi/exevents.c.
    - debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
      device for XIAttachToMaster in Xi/xichangehierarchy.c.
    - CVE-2024-0229
  * SECURITY UPDATE: SELinux unlabeled GLX PBuffer
    - debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
      in glx/glxcmds.c.
    - CVE-2024-0408
  * SECURITY UPDATE: SELinux context corruption
    - debian/patches/CVE-2024-0409.patch: use the proper private key for
      cursor in hw/kdrive/ephyr/ephyrcursor.c,
      hw/xwayland/xwayland-cursor.c.
    - CVE-2024-0409
  * SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
    - debian/patches/CVE-2024-21885.patch: flush hierarchy events after
      adding/removing master devices in Xi/xichangehierarchy.c.
    - CVE-2024-21885
  * SECURITY UPDATE: Heap buffer overflow in DisableDevice
    - debian/patches/CVE-2024-21886-1.patch: do not keep linked list
      pointer during recursion in dix/devices.c.
    - debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
      disabled slaved devices too in dix/devices.c.
    - CVE-2024-21886

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 15 Jan 2024 10:45:41 -0500

xorg-server (2:1.20.13-1ubuntu1~20.04.12) focal-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds memory write in XKB button actions
    - debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for
      our buttons in Xi/exevents.c, dix/devices.c.
    - CVE-2023-6377
  * SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty
    and RRChangeProviderProperty
    - debian/patches/CVE-2023-6478.patch: avoid integer truncation in
      length check of ProcRRChange*Property in randr/rrproperty.c,
      randr/rrproviderproperty.c.
    - CVE-2023-6478

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 12 Dec 2023 20:29:21 -0500

xorg-server (2:1.20.13-1ubuntu1~20.04.9) focal-security; urgency=medium

  * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
    RRChangeOutputProperty
    - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
      and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
    - CVE-2023-5367
  * SECURITY UPDATE: Use-after-free bug in DestroyWindow
    - debian/patches/CVE-2023-5380.patch: reset the PointerWindows
      reference on screen switch in dix/enterleave.h, include/eventstr.h,
      mi/mipointer.c.
    - CVE-2023-5380

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 23 Oct 2023 12:31:55 -0400

xorg-server (2:1.20.13-1ubuntu1~20.04.8) focal-security; urgency=medium

  * SECURITY UPDATE: Overlay Window Use-After-Free
    - debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in
      composite/compwindow.c.
    - CVE-2023-1393

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Mar 2023 08:53:02 -0400

# For older changelog entries, run 'apt-get changelog xserver-xorg-core'
