CVSROOT: /cvs
Module name: xenocara
Changes by: [email protected] 2026/11/04 09:11:34
Modified files:
lib/libX11/modules/im/ximcp: Tag: OPENBSD_8_0 imDefIm.c
imDefLkup.c imRmAttr.c
lib/libX11/modules/lc/gen: Tag: OPENBSD_8_0 lcGenConv.c
lib/libX11/src/xkb: Tag: OPENBSD_8_0 XKBGetMap.c
lib/libX11/src/xlibi18n: Tag: OPENBSD_8_0 XimintP.h
lib/libXi/src : Tag: OPENBSD_8_0 XExtInt.c XGetDCtl.c
XIQueryDevice.c XListDev.c XQueryDv.c
lib/libXpm/src : Tag: OPENBSD_8_0 parse.c
lib/libXrender/src: Tag: OPENBSD_8_0 Xrender.c
lib/libXtst/src: Tag: OPENBSD_8_0 XRecord.c
Log message:
Merge fixes from upstream for X client library issues:
* CVE-2026-88806: libX11 xkb: Check the keysym range in _XkbReadKeyActions
* CVE-2026-94283: libX11 ximcp: bound XIM_OPEN_REPLY attribute lengths
* CVE-2026-94284: libX11 ximcp: bound XIM_REGISTER_TRIGGERKEYS keylist lengths
* CVE-2026-94285: libX11 lcGenConv: bound byteM_parse_codeset() reads
* CVE-2026-93541: libXi XQueryDeviceState: check ValuatorClass num_valuators
* CVE-2026-93542: libXi size_classes/copy_classes: bound XI2 class lengths
* CVE-2026-93543: libXi size_classes/copy_classes: enforce XI2 class sizes
* CVE-2026-93544: libXi XIQueryDevice: keep padded name and class bytes
* CVE-2026-93545: libXi XListInputDevices: validate device name lengths
* CVE-2026-94281: libXi XListInputDevices: validate class lengths
* CVE-2026-94282: libXi wireToEnterLeave: validate buttons_len
* CVE-2026-109089: libXi XGetDeviceControl: reply control must match request
* CVE-2026-109090: libXi XGetDeviceControl: size DEVICE_ENABLE replies
* CVE-2026-94287: libXpm ParsePixels: reject zero-dimension XPM images
* CVE-2026-88807: libXrender: Check numSubpixel against numScreens
* CVE-2026-94286: libXtst parse_reply_call_callback: check element size
* CVE-2026-109088: libXtst parse_reply_call_callback: reject zero progress
from matthieu@
this is errata/8.0/007_xlibs.patch.sig
