Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xwayland for openSUSE:Factory checked in at 2026-11-11 16:23:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xwayland (Old) and /work/SRC/openSUSE:Factory/.xwayland.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xwayland" Wed Nov 11 16:23:51 2026 rev:55 rq:1396536 version:24.1.14 Changes: -------- --- /work/SRC/openSUSE:Factory/xwayland/xwayland.changes 2026-10-22 19:24:52.451702650 +0200 +++ /work/SRC/openSUSE:Factory/.xwayland.new.3759290/xwayland.changes 2026-11-11 16:24:01.044569650 +0100 @@ -1,0 +2,25 @@ +Wed Oct 21 12:20:30 UTC 2026 - Stefan Dirsch <[email protected]> + +- bsc1285087_CVE-2026-109092.patch + * X.Org Server XvShmPutImage Shared-Memory Bounds Overflow + (bsc#1285087, CVE-2026-109092) +- bsc1285088_CVE-2026-109093.patch + * X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write + (bsc#1285088, CVE-2026-109093) +- bsc1285089_CVE-2026-109094.patch + * X.Org Server XRes QueryResourceBytes Swap Path Size Overflow + (bsc#1285089, CVE-2026-109094) +- bsc1285090_CVE-2026-109095.patch + * X.Org Server glamor Xv Image Size Integer Overflow + (bsc#1285090, CVE-2026-109095) +- bsc1285091_CVE-2026-109096.patch + * X.Org Server XvPutImage Negative Image Size Length Bypass + (bsc#1285091, CVE-2026-109096 +- bsc1285093_CVE-2026-109903.patch + * X.Org Server XRes QueryClientIds Request Size Overflow + (bsc#1285093, CVE-2026-109903) +- bsc1285094_CVE-2026-109904.patch + * X.Org Server XRes QueryClientIds Request Size Overflow + (bsc#1285094, CVE-2026-109904) + +------------------------------------------------------------------- New: ---- bsc1285087_CVE-2026-109092.patch bsc1285088_CVE-2026-109093.patch bsc1285089_CVE-2026-109094.patch bsc1285090_CVE-2026-109095.patch bsc1285091_CVE-2026-109096.patch bsc1285093_CVE-2026-109903.patch bsc1285094_CVE-2026-109904.patch ----------(New B)---------- New: - bsc1285087_CVE-2026-109092.patch * X.Org Server XvShmPutImage Shared-Memory Bounds Overflow New: (bsc#1285087, CVE-2026-109092) - bsc1285088_CVE-2026-109093.patch * X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write New: (bsc#1285088, CVE-2026-109093) - bsc1285089_CVE-2026-109094.patch * X.Org Server XRes QueryResourceBytes Swap Path Size Overflow New: (bsc#1285089, CVE-2026-109094) - bsc1285090_CVE-2026-109095.patch * X.Org Server glamor Xv Image Size Integer Overflow New: (bsc#1285090, CVE-2026-109095) - bsc1285091_CVE-2026-109096.patch * X.Org Server XvPutImage Negative Image Size Length Bypass New: (bsc#1285091, CVE-2026-109096 - bsc1285093_CVE-2026-109903.patch * X.Org Server XRes QueryClientIds Request Size Overflow New: (bsc#1285093, CVE-2026-109903) - bsc1285094_CVE-2026-109904.patch * X.Org Server XRes QueryClientIds Request Size Overflow ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xwayland.spec ++++++ --- /var/tmp/diff_new_pack.xL2jFf/_old 2026-11-11 16:24:02.460629043 +0100 +++ /var/tmp/diff_new_pack.xL2jFf/_new 2026-11-11 16:24:02.462629127 +0100 @@ -37,6 +37,13 @@ Source1: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig Source2: xwayland.keyring Patch3: U_xwayland_Dont_run_key_behaviors_and_actions.patch +Patch1285087: bsc1285087_CVE-2026-109092.patch +Patch1285088: bsc1285088_CVE-2026-109093.patch +Patch1285089: bsc1285089_CVE-2026-109094.patch +Patch1285090: bsc1285090_CVE-2026-109095.patch +Patch1285091: bsc1285091_CVE-2026-109096.patch +Patch1285093: bsc1285093_CVE-2026-109903.patch +Patch1285094: bsc1285094_CVE-2026-109904.patch BuildRequires: meson BuildRequires: ninja BuildRequires: pkgconfig ++++++ bsc1285087_CVE-2026-109092.patch ++++++ >From b0335b6e615b8e72ff6c414978c96d8222dcb72e Mon Sep 17 00:00:00 2001 From: Acts1631 <[email protected]> Date: Tue, 21 Jul 2026 10:57:50 -0400 Subject: [PATCH xserver 03/16] Xv: prevent overflow in shared-memory bounds check A crafted XvShmPutImage offset could wrap the image-size addition before range validation and pass an invalid source pointer to the DDX. Reject negative image sizes and validate the offset and required range with subtraction before deriving the source pointer. CVE-2026-109092 --- Xext/xvdisp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c index 41d511553..84e6be1df 100644 --- a/Xext/xvdisp.c +++ b/Xext/xvdisp.c @@ -919,7 +919,8 @@ ProcXvShmPutImage(ClientPtr client) size_needed = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage, &width, &height, NULL, NULL); - if ((size_needed + stuff->offset) > shmdesc->size) + if (size_needed < 0 || stuff->offset > shmdesc->size || + (unsigned long) size_needed > shmdesc->size - stuff->offset) return BadAccess; if ((width < stuff->width) || (height < stuff->height)) -- 2.56.0 ++++++ bsc1285088_CVE-2026-109093.patch ++++++ >From 77823ac670339033af42428264578e11878e2ed7 Mon Sep 17 00:00:00 2001 From: Acts1631 <[email protected]> Date: Tue, 21 Jul 2026 11:32:24 -0400 Subject: [PATCH xserver 05/16] XTest: validate valuator range before writing XTestFakeInput copied device valuators into a fixed stack array before checking whether the record fit in the target device axis range. A high-axis device and crafted request could write past the array. Validate the count and range before indexing the stack array. CVE-2026-109093 --- Xext/xtest.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) Index: xwayland-24.1.14/Xext/xtest.c =================================================================== --- xwayland-24.1.14.orig/Xext/xtest.c +++ xwayland-24.1.14/Xext/xtest.c @@ -284,6 +284,12 @@ ProcXTestFakeInput(ClientPtr client) client->errorValue = dv->first_valuator; return BadValue; } + if (!dv->num_valuators || dv->num_valuators > 6 || + base + dv->num_valuators > dev->valuator->numAxes || + base + dv->num_valuators > MAX_VALUATORS) { + client->errorValue = dv->num_valuators; + return BadValue; + } switch (dv->num_valuators) { case 6: valuators[base + 5] = dv->valuator5; @@ -310,11 +316,6 @@ ProcXTestFakeInput(ClientPtr client) base += dv->num_valuators; numValuators += dv->num_valuators; - - if (firstValuator + numValuators > dev->valuator->numAxes) { - client->errorValue = dv->num_valuators; - return BadValue; - } } type = type - XI_DeviceKeyPress + KeyPress; ++++++ bsc1285089_CVE-2026-109094.patch ++++++ >From 13876f736eec4e81b1001a8fde650544fcaeb4fc Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Fri, 2 Oct 2026 15:42:42 +0200 Subject: [PATCH xserver 09/16] XRes: prevent overflow in resource bytes swap path SProcXResQueryResourceBytes multiplied numSpecs by the spec size before REQUEST_FIXED_SIZE without an overflow check. On 32-bit servers, a large numSpecs can wrap, pass length validation, and walk the swap loop past the request buffer. Reject numSpecs values that would cause an overflow before validating or swapping the array, matching ProcXResQueryResourceBytes. CVE-2026-109094 Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI --- Xext/xres.c | 2 ++ 1 file changed, 2 insertions(+) Index: xwayland-24.1.14/Xext/xres.c =================================================================== --- xwayland-24.1.14.orig/Xext/xres.c +++ xwayland-24.1.14/Xext/xres.c @@ -1068,6 +1068,8 @@ SProcXResQueryResourceBytes (ClientPtr c REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); swapl(&stuff->numSpecs); + if (stuff->numSpecs > UINT32_MAX / sizeof(specs[0])) + return BadLength; REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, stuff->numSpecs * sizeof(specs[0])); ++++++ bsc1285090_CVE-2026-109095.patch ++++++ >From b4c3257d14f0fb793a5f5a3e947683a05761d609 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Fri, 2 Oct 2026 15:58:36 +0200 Subject: [PATCH xserver 11/16] glamor: prevent overflow in Xv image size calculation glamor_xv_query_image_attributes() computed image sizes with 32-bit signed ints. Large CARD16 width/height values (especially for NV12 and YV12/I420) wrap the result, so protocol length checks can accept requests that lack the required image payload. Compute sizes with 64-bit arithmetic and return -1 when the result does not fit in int, so callers can reject the request. CVE-2026-109095 Reported-by: Tristan <[email protected]> Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI --- glamor/glamor_xv.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/glamor/glamor_xv.c b/glamor/glamor_xv.c index 8a0677131..aa5114e03 100644 --- a/glamor/glamor_xv.c +++ b/glamor/glamor_xv.c @@ -330,7 +330,7 @@ glamor_xv_query_image_attributes(int id, unsigned short *w, unsigned short *h, int *pitches, int *offsets) { - int size = 0, tmp; + int64_t size = 0, tmp; if (offsets) offsets[0] = 0; @@ -343,6 +343,8 @@ glamor_xv_query_image_attributes(int id, if (pitches) pitches[0] = size; size *= *h; + if (size > INT_MAX) + return -1; if (offsets) offsets[1] = size; tmp = ALIGN(*w >> 1, 4); @@ -350,6 +352,8 @@ glamor_xv_query_image_attributes(int id, pitches[1] = pitches[2] = tmp; tmp *= (*h >> 1); size += tmp; + if (size > INT_MAX) + return -1; if (offsets) offsets[2] = size; size += tmp; @@ -361,6 +365,8 @@ glamor_xv_query_image_attributes(int id, if (pitches) pitches[0] = size; size *= *h; + if (size > INT_MAX) + return -1; if (offsets) offsets[1] = size; tmp = ALIGN(*w, 4); @@ -395,6 +401,8 @@ glamor_xv_query_image_attributes(int id, size *= *h; break; } + if (size > INT_MAX) + return -1; return size; } -- 2.56.0 ++++++ bsc1285091_CVE-2026-109096.patch ++++++ >From 8f6c8867fe97dbeddc41f7a57434255e292c2f4a Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Fri, 2 Oct 2026 15:58:45 +0200 Subject: [PATCH xserver 13/16] Xv: reject negative image size in PutImage ddQueryImageAttributes() can return a negative size when the adaptor overflows during size calculation. Adding that value to the request header size can make the length check accept a request that does not contain the claimed image data. Reject negative sizes before validating the request length. CVE-2026-109096 Reported-by: Tristan <[email protected]> Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI --- Xext/xvdisp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c index 84e6be1df..55b25b4be 100644 --- a/Xext/xvdisp.c +++ b/Xext/xvdisp.c @@ -853,6 +853,9 @@ ProcXvPutImage(ClientPtr client) height = stuff->height; size = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage, &width, &height, NULL, NULL); + if (size < 0) + return BadValue; + size += sizeof(xvPutImageReq); size = bytes_to_int32(size); -- 2.56.0 ++++++ bsc1285093_CVE-2026-109903.patch ++++++ >From c015738f8659207cf6d7807ad6f3b671a5f90b3b Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Fri, 2 Oct 2026 15:58:58 +0200 Subject: [PATCH xserver 15/16] Xv: reject negative image size in QueryImageAttributes When ddQueryImageAttributes() overflows and returns a negative size, QueryImageAttributes would still reply with that value cast to CARD32, reporting a bogus data_size to the client. Reject negative sizes with BadValue. CVE-2026-109903 Reported-by: Tristan <[email protected]> Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI --- Xext/xvdisp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c index 55b25b4be..1c889c2aa 100644 --- a/Xext/xvdisp.c +++ b/Xext/xvdisp.c @@ -1006,6 +1006,10 @@ ProcXvQueryImageAttributes(ClientPtr client) size = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage, &width, &height, offsets, pitches); + if (size < 0) { + free(offsets); + return BadValue; + } rep = (xvQueryImageAttributesReply) { .type = X_Reply, -- 2.56.0 ++++++ bsc1285094_CVE-2026-109904.patch ++++++ >From c29f66e65c42dc80bebad30991116f64c28c06bf Mon Sep 17 00:00:00 2001 From: Acts1631 <[email protected]> Date: Tue, 21 Jul 2026 12:13:56 -0400 Subject: [PATCH xserver 07/16] XRes: prevent overflow in client ID request size On 32-bit servers, a QueryClientIds request can overflow numSpecs * sizeof(xXResClientIdSpec) before REQUEST_FIXED_SIZE checks it. A small request with a large numSpecs can therefore pass validation and drive the normal or swapped handler past the request buffer. Reject numSpecs values that cannot be represented in the request-size calculation before validating or accessing the array. CVE-2026-109904 --- Xext/xres.c | 4 ++++ 1 file changed, 4 insertions(+) Index: xwayland-24.1.14/Xext/xres.c =================================================================== --- xwayland-24.1.14.orig/Xext/xres.c +++ xwayland-24.1.14/Xext/xres.c @@ -583,6 +583,8 @@ ProcXResQueryClientIds (ClientPtr client InitConstructClientIdCtx(&ctx); REQUEST_AT_LEAST_SIZE(xXResQueryClientIdsReq); + if (stuff->numSpecs > UINT32_MAX / sizeof(specs[0])) + return BadLength; REQUEST_FIXED_SIZE(xXResQueryClientIdsReq, stuff->numSpecs * sizeof(specs[0]));
