xwayland (2:23.2.0-1ubuntu0.6) mantic-security; urgency=medium

  * SECURITY REGRESSION: Fix for CVE-2024-31083 introduced a potential
    double-free error, causing X to crash
    - debian/patches/CVE-2024-31083-regression_fix-MR_1476.patch:
      render: Avoid possible double-free in ProcRenderAddGlyphs()
    - LP: #2060354

 -- Steve Beattie <steve.beattie@canonical.com>  Mon, 08 Apr 2024 20:37:39 -0700

xwayland (2:23.2.0-1ubuntu0.5) mantic-security; urgency=medium

  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31080.patch: fixes byte
      swapping in replies in Xi/xiselectev.c.
    - CVE-2024-31080
  * SECURITY UPDATE: Heap buffer over read
    - debian/patches/CVE-2024-31081.patch: fixes byte
      swapping in replies in Xi/xipassivegrab.c.
    - CVE-2024-31081
  * SECURITY UPDATE: User-after-free
    - debian/patches/CVE-2024-31083.patch: fix recounting of glyphs
      during ProcRenderAddGlyphs in render/glyph.c.
    - CVE-2024-31083

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 01 Apr 2024 16:53:20 -0300

xwayland (2:23.2.0-1ubuntu0.4) mantic-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in DeviceFocusEvent and
    ProcXIQueryPointer
    - debian/patches/CVE-2023-6816.patch: allocate enough space for logical
      button maps in Xi/xiquerypointer.c, dix/enterleave.c.
    - CVE-2023-6816
  * SECURITY UPDATE: Reattaching to different master device may lead to
    out-of-bounds memory access
    - debian/patches/CVE-2024-0229-1.patch: allocate sufficient xEvents for
      our DeviceStateNotify in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-2.patch: fix DeviceStateNotify event
      calculation in dix/enterleave.c.
    - debian/patches/CVE-2024-0229-3.patch: when creating a new
      ButtonClass, set the number of buttons in Xi/exevents.c.
    - debian/patches/CVE-2024-0229-4.patch: require a pointer and keyboard
      device for XIAttachToMaster in Xi/xichangehierarchy.c.
    - CVE-2024-0229
  * SECURITY UPDATE: SELinux unlabeled GLX PBuffer
    - debian/patches/CVE-2024-0408.patch: call XACE hooks on the GLX buffer
      in glx/glxcmds.c.
    - CVE-2024-0408
  * SECURITY UPDATE: SELinux context corruption
    - debian/patches/CVE-2024-0409.patch: use the proper private key for
      cursor in hw/xwayland/xwayland-cursor.c.
    - CVE-2024-0409
  * SECURITY UPDATE: Heap buffer overflow in XISendDeviceHierarchyEvent
    - debian/patches/CVE-2024-21885.patch: flush hierarchy events after
      adding/removing master devices in Xi/xichangehierarchy.c.
    - CVE-2024-21885
  * SECURITY UPDATE: Heap buffer overflow in DisableDevice
    - debian/patches/CVE-2024-21886-1.patch: do not keep linked list
      pointer during recursion in dix/devices.c.
    - debian/patches/CVE-2024-21886-2.patch: when disabling a master, float
      disabled slaved devices too in dix/devices.c.
    - CVE-2024-21886

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 15 Jan 2024 13:03:30 -0500

xwayland (2:23.2.0-1ubuntu0.3) mantic-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds memory write in XKB button actions
    - debian/patches/CVE-2023-6377.patch: allocate enough XkbActions for
      our buttons in Xi/exevents.c, dix/devices.c.
    - CVE-2023-6377
  * SECURITY UPDATE: Out-of-bounds memory read in RRChangeOutputProperty
    and RRChangeProviderProperty
    - debian/patches/CVE-2023-6478.patch: avoid integer truncation in
      length check of ProcRRChange*Property in randr/rrproperty.c,
      randr/rrproviderproperty.c.
    - CVE-2023-6478

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 12 Dec 2023 20:30:20 -0500

xwayland (2:23.2.0-1ubuntu0.1) mantic-security; urgency=medium

  * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
    RRChangeOutputProperty
    - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
      and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
    - CVE-2023-5367

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 16 Oct 2023 09:12:41 -0400

xwayland (2:23.2.0-1) unstable; urgency=medium

  * New upstream release.
  * patches: Refreshed.
  * control: Bump x11proto-dev depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Aug 2023 15:27:59 +0300

xwayland (2:23.1.1-1) experimental; urgency=medium

  * New upstream release.
  * control: Fix cross-building, add libwayland-dev:native to build-
    depends. (Closes: #1002515)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 11 May 2023 13:10:04 +0300

xwayland (2:23.1.0-1) experimental; urgency=medium

  * New upstream release.
  * patches: Refreshed.
  * install: Add desktop file.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 24 Mar 2023 11:26:25 +0200

xwayland (2:22.1.8-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-0494

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 07 Feb 2023 15:14:38 +0200

xwayland (2:22.1.7-1) unstable; urgency=medium

  * New upstream release.
  * rules, install: Ship the .pc file. (Closes: #1025742)
  * rules: Enable full hardening flags. (Closes: #1026168)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 24 Jan 2023 09:37:32 +0200

xwayland (2:22.1.6-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-46340, CVE-2022-46341, CVE-2022-46342, CVE-2022-46343,
      CVE-2022-46344, CVE-2022-4283
  * Add signing-key from Peter Hutterer.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Dec 2022 16:26:30 +0200

xwayland (2:22.1.5-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 03 Nov 2022 15:38:36 +0100

xwayland (2:22.1.3-2) unstable; urgency=medium

  [ Daniel van Vugt ]
  * Add xwayland-Detect-gbm_bo_get_fd_for_plane-at-runtime.patch

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 25 Aug 2022 13:03:43 +0300

xwayland (2:22.1.3-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-2319, CVE-2022-2320

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 26 Jul 2022 14:39:48 +0300

xwayland (2:22.1.2-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 02 Jun 2022 15:16:00 +0300

xwayland (2:22.1.1-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 01 Apr 2022 09:40:47 +0300

xwayland (2:22.1.0-1) unstable; urgency=medium

  * New upstream release.
  * control: Bump policy to 4.6.0.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Feb 2022 20:20:06 +0200

xwayland (2:22.0.99.902-1) unstable; urgency=medium

  * New upstream release candidate.
  * control: Add libxcvt-dev to build-depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 03 Feb 2022 12:56:33 +0200

xwayland (2:21.1.4-1) unstable; urgency=medium

  * New upstream release.
  * render: Fix out of bounds access in SProcRenderCompositeGlyphs()
    [CVE-2021-4008]
  * xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
    [CVE-2021-4009]
  * Xext: Fix out of bounds access in SProcScreenSaverSuspend()
    [CVE-2021-4010]
  * record: Fix out of bounds access in SwapCreateRegister()
    [CVE-2021-4011]

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Dec 2021 16:19:18 +0200

xwayland (2:21.1.3-1) unstable; urgency=medium

  * Initial release. (Closes: #981841, #992146)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 08 Nov 2021 16:39:28 +0200
