Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libXi for openSUSE:Factory checked in at 2026-10-16 20:07:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libXi (Old) and /work/SRC/openSUSE:Factory/.libXi.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libXi" Fri Oct 16 20:07:05 2026 rev:25 rq:1385038 version:1.8.3 Changes: -------- --- /work/SRC/openSUSE:Factory/libXi/libXi.changes 2026-09-28 10:34:57.798076500 +0200 +++ /work/SRC/openSUSE:Factory/.libXi.new.3698736/libXi.changes 2026-10-16 20:07:21.878314394 +0200 @@ -1,0 +2,10 @@ +Thu Oct 15 14:03:37 UTC 2026 - Stefan Dirsch <[email protected]> + +- boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch + * XGetDeviceControl Control Type Mismatch Heap Buffer Overflow + (bsc#1285084, CVE-2026-109089) +- boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch + * XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow + (bsc#1285085, CVE-2026-109090) + +------------------------------------------------------------------- New: ---- boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch ----------(New B)---------- New: - boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch * XGetDeviceControl Control Type Mismatch Heap Buffer Overflow New: (bsc#1285084, CVE-2026-109089) - boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch * XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libXi.spec ++++++ --- /var/tmp/diff_new_pack.Hh9p01/_old 2026-10-16 20:07:22.775351876 +0200 +++ /var/tmp/diff_new_pack.Hh9p01/_new 2026-10-16 20:07:22.777351960 +0200 @@ -27,7 +27,7 @@ #Git-Clone: git://anongit.freedesktop.org/xorg/lib/libXi #Git-Web: http://cgit.freedesktop.org/xorg/lib/libXi/ -Source: http://xorg.freedesktop.org/releases/individual/lib/%{name}-%{version}.tar.xz +Source: http://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.xz Source1: baselibs.conf Patch1: 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch Patch2: 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch @@ -36,6 +36,8 @@ Patch5: 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch Patch6: 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch Patch7: 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch +Patch8: boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch +Patch9: boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build #git#BuildRequires: autoconf >= 2.60, automake, libtool BuildRequires: fdupes ++++++ boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch ++++++ >From f7836d0a0f45e9e6c2c147c5dea4b6bc08231f2e Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Thu, 1 Oct 2026 15:01:03 +0200 Subject: [PATCH] XGetDeviceControl: require reply control to match the request Size and fill both used to key off different values, so a hostile server could answer DEVICE_RESOLUTION with a small fixed-size control and still drive the unbounded valuator copy. CVE-2026-109089 Reported-by: Adam Bedard, Security Researcher. Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/26> --- src/XGetDCtl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/XGetDCtl.c b/src/XGetDCtl.c index 7f6b396..fbde6d7 100644 --- a/src/XGetDCtl.c +++ b/src/XGetDCtl.c @@ -105,13 +105,17 @@ XGetDeviceControl( sav = d; _XRead(dpy, (char *)d, nbytes); + /* Allocation and fill must agree; reject a mismatched reply type. */ + if (d->control != control) + goto out; + /* In theory, we should just be able to use d->length to get the size. * Turns out that a number of X servers (up to and including server * 1.4) sent the wrong length value down the wire. So to not break * apps that run against older servers, we have to calculate the size * manually. */ - switch (d->control) { + switch (control) { case DEVICE_RESOLUTION: { xDeviceResolutionState *r; -- 2.51.0 ++++++ boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch ++++++ >From 4eb9f70b67034ace1abdf785fd8dcba7b6dc739d Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Thu, 8 Oct 2026 10:58:33 +0200 Subject: [PATCH] XGetDeviceControl: size DEVICE_ENABLE replies for XDeviceEnableState DEVICE_ENABLE had a fill path but no size arm, so allocation used the wire length (8 bytes) while the fill wrote a full XDeviceEnableState. CVE-2026-109090 Reported-by: Adam Bedard, Security Researcher. Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/26> --- src/XGetDCtl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/XGetDCtl.c b/src/XGetDCtl.c index fbde6d7..b11e0a4 100644 --- a/src/XGetDCtl.c +++ b/src/XGetDCtl.c @@ -152,6 +152,13 @@ XGetDeviceControl( size = sizeof(XDeviceCoreState); break; } + case DEVICE_ENABLE: + { + if (sizeof(xDeviceEnableState) > nbytes) + goto out; + size = sizeof(XDeviceEnableState); + break; + } default: if (d->length > nbytes) goto out; -- 2.51.0
