Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libXrender for openSUSE:Factory checked in at 2026-09-21 12:00:58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libXrender (Old) and /work/SRC/openSUSE:Factory/.libXrender.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libXrender" Mon Sep 21 12:00:58 2026 rev:13 rq:1378816 version:0.9.12 Changes: -------- --- /work/SRC/openSUSE:Factory/libXrender/libXrender.changes 2024-12-15 12:34:40.075911678 +0100 +++ /work/SRC/openSUSE:Factory/.libXrender.new.383539/libXrender.changes 2026-09-21 12:01:08.070993490 +0200 @@ -1,0 +2,9 @@ +Fri Sep 18 12:56:42 UTC 2026 - Stefan Dirsch <[email protected]> + +- u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch + * A malicious server could reply to XRenderQueryFormat with a + numSubpixels count greater than the number of screens, causing + an OOB write into screen->subpixel which was allocated using + numScreens (CVE-2026-88807, ZDI-CAN-32093, bsc#1280911) + +------------------------------------------------------------------- New: ---- u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch ----------(New B)---------- New: - u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch * A malicious server could reply to XRenderQueryFormat with a ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libXrender.spec ++++++ --- /var/tmp/diff_new_pack.56t8Us/_old 2026-09-21 12:01:09.443051034 +0200 +++ /var/tmp/diff_new_pack.56t8Us/_new 2026-09-21 12:01:09.444051076 +0200 @@ -1,7 +1,7 @@ # # spec file for package libXrender # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -29,6 +29,7 @@ #Git-Web: http://cgit.freedesktop.org/xorg/lib/libXrender/ Source: http://xorg.freedesktop.org/releases/individual/lib/%{name}-%{version}.tar.xz Source1: baselibs.conf +Patch1280911: u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build #git#BuildRequires: autoconf >= 2.60, automake, libtool BuildRequires: pkgconfig @@ -68,6 +69,7 @@ %prep %setup -q +%patch -P 1280911 -p1 %build %configure --docdir=%_docdir/%name --disable-static ++++++ u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch ++++++ >From 4bbe38dc59733ea23534b909814f7a062531ebbb Mon Sep 17 00:00:00 2001 From: Peter Hutterer <[email protected]> Date: Wed, 16 Sep 2026 16:07:39 +1000 Subject: [PATCH] Check numSubpixel against numScreens to avoid OOB writes (CVE-2026-88807) A malicious server could reply to XRenderQueryFormat with a numSubpixels count greater than the number of screens, causing an OOB write into screen->subpixel which was allocated using numScreens. This vulnerability was discovered by: Adam Bedard working with TrendAI Zero Day Initiative ZDI-CAN-32093 CVE-2026-88807 Assisted-by: Claude:claude-opus-4-6 --- src/Xrender.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/Xrender.c b/src/Xrender.c index 3080d00..5cdd437 100644 --- a/src/Xrender.c +++ b/src/Xrender.c @@ -478,6 +478,7 @@ XRenderQueryFormats (Display *dpy) (rep.numDepths < ((INT_MAX / 4) / sizeof (XRenderDepth))) && (rep.numVisuals < ((INT_MAX / 4) / sizeof (XRenderVisual))) && (rep.numSubpixel < ((INT_MAX / 4) / 4)) && + (rep.numSubpixel <= rep.numScreens) && (rep.length < (INT_MAX >> 2)) ) { /* Zero-initialize so that pointers are NULL if there is a failure. */ xri = Xcalloc (1, sizeof (XRenderInfo)); -- 2.51.0
