Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libX11 for openSUSE:Factory checked in at 2026-09-21 12:01:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libX11 (Old) and /work/SRC/openSUSE:Factory/.libX11.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libX11" Mon Sep 21 12:01:00 2026 rev:61 rq:1378818 version:1.8.13 Changes: -------- --- /work/SRC/openSUSE:Factory/libX11/libX11.changes 2026-02-10 21:10:44.519337813 +0100 +++ /work/SRC/openSUSE:Factory/.libX11.new.383539/libX11.changes 2026-09-21 12:01:10.807108242 +0200 @@ -1,0 +2,7 @@ +Fri Sep 18 11:05:08 UTC 2026 - Stefan Dirsch <[email protected]> + +- u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch + * libX11 XkbGetMap Reply Heap-based Buffer Overflow + (CVE-2026-88806, ZDI-CAN-32061, bsc#1280910) + +------------------------------------------------------------------- New: ---- u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch ----------(New B)---------- New: - u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch * libX11 XkbGetMap Reply Heap-based Buffer Overflow ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libX11.spec ++++++ --- /var/tmp/diff_new_pack.eO5LQH/_old 2026-09-21 12:01:12.396174887 +0200 +++ /var/tmp/diff_new_pack.eO5LQH/_new 2026-09-21 12:01:12.401175097 +0200 @@ -32,6 +32,7 @@ # PATCH-FIX-UPSTREAM en-locales.diff fdo#48596 bnc#388711 -- Add missing data for more en locales Patch2: en-locales.diff Patch3: u_no-longer-crash-in-XVisualIDFromVisual.patch +Patch4: u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch BuildRequires: fdupes BuildRequires: libtool BuildRequires: pkgconfig @@ -121,6 +122,7 @@ %patch -P 1 %patch -P 2 %patch -P 3 -p1 +%patch -P 4 -p1 %build %configure \ ++++++ u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch ++++++ >From f371943bfc62e9951bf8e27174df8790f320b635 Mon Sep 17 00:00:00 2001 From: Peter Hutterer <[email protected]> Date: Wed, 16 Sep 2026 15:27:33 +1000 Subject: [PATCH] xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806) A malicious server could send a XkbGetMap reply with firstKeyAct + nKeyActs exceeding max_keycode=+ 1. This would cause an OOB write into info->map->key_sym_map[rep->firstKeyAct + i]. This brings this function in line with the other functions in this file which already have checks in place. This vulnerability was discovered by: Adam Bedard working with TrendAI Zero Day Initiative ZDI-CAN-32061 CVE-2026-88806 Assisted-by: Claude:claude-opus-4-6 --- src/xkb/XKBGetMap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c index 31199e4a..eaa0d6d5 100644 --- a/src/xkb/XKBGetMap.c +++ b/src/xkb/XKBGetMap.c @@ -253,6 +253,9 @@ _XkbReadKeyActions(XkbReadBufferPtr buf, XkbDescPtr info, xkbGetMapReply *rep) if ((nKeyActs = rep->nKeyActs) > 0) { XkbSymMapPtr symMap; + if (((int) rep->firstKeyAct + rep->nKeyActs) > (info->max_key_code + 1)) + return BadLength; + if (nKeyActs < sizeof numDescBuf) numDesc = numDescBuf; else -- 2.51.0
