Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libXi for openSUSE:Factory checked in at 2026-10-18 19:22:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libXi (Old) and /work/SRC/openSUSE:Factory/.libXi.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libXi" Sun Oct 18 19:22:28 2026 rev:26 rq:1385478 version:1.8.4 Changes: -------- --- /work/SRC/openSUSE:Factory/libXi/libXi.changes 2026-10-16 20:07:21.878314394 +0200 +++ /work/SRC/openSUSE:Factory/.libXi.new.3698736/libXi.changes 2026-10-18 19:22:37.184008392 +0200 @@ -1,0 +2,18 @@ +Sat Oct 17 12:17:18 UTC 2026 - Stefan Dirsch <[email protected]> + +- Update to version 1.8.4 + * This release includes the fixes for the issues listed in + https://lists.x.org/archives/xorg-announce/2026-October/003752.html + as well as additional hardening and bug fixes. +- supersedes the following patches: + * 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch + * 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch + * 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch + * 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch + * 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch + * 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch + * 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch + * boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch + * boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch + +------------------------------------------------------------------- Old: ---- 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch libXi-1.8.3.tar.xz New: ---- libXi-1.8.4.tar.xz ----------(Old B)---------- Old:- supersedes the following patches: * 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch * 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch Old: * 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch * 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch * 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch Old: * 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch * 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch * 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch Old: * 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch * 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch * 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch Old: * 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch * 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch * 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch Old: * 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch * 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch * 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch Old: * 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch * 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch * boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch Old: * 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch * boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch * boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch Old: * boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch * boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libXi.spec ++++++ --- /var/tmp/diff_new_pack.w6EFr5/_old 2026-10-18 19:22:38.741072945 +0200 +++ /var/tmp/diff_new_pack.w6EFr5/_new 2026-10-18 19:22:38.745073111 +0200 @@ -18,7 +18,7 @@ Name: libXi %define lname libXi6 -Version: 1.8.3 +Version: 1.8.4 Release: 0 Summary: X Input Extension library License: MIT @@ -29,15 +29,6 @@ #Git-Web: http://cgit.freedesktop.org/xorg/lib/libXi/ Source: http://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.xz Source1: baselibs.conf -Patch1: 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch -Patch2: 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch -Patch3: 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch -Patch4: 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch -Patch5: 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch -Patch6: 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch -Patch7: 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch -Patch8: boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch -Patch9: boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build #git#BuildRequires: autoconf >= 2.60, automake, libtool BuildRequires: fdupes ++++++ libXi-1.8.3.tar.xz -> libXi-1.8.4.tar.xz ++++++ ++++ 21257 lines of diff (skipped)
