From 64f6f2d06ef7e56c72438117de0e644b15cde1b8 Mon Sep 17 00:00:00 2001 From: Raphael Pavlidis Date: Fri, 5 Dec 2025 17:18:37 +0000 Subject: [PATCH] package/xwayland: security bump to version 24.1.9 Fixes the following security issues: 1) CVE-2025-62229: Use-after-free in XPresentNotify structures creation Using the X11 Present extension, when processing and adding the notifications after presenting a pixmap, if an error occurs, a dangling pointer may be left in the error code path of the function causing a use-after-free when eventually destroying the notification structures later. Introduced in: Xorg 1.15 Fixed in: xorg-server-21.1.19 and xwayland-24.1.9 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b1 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. 2) CVE-2025-62230: Use-after-free in Xkb client resource removal When removing the Xkb resources for a client, the function XkbRemoveResourceClient() will free the XkbInterest data associated with the device, but not the resource associated with it. As a result, when the client terminates, the resource delete function triggers a use-after-free. Introduced in: X11R6 Fixed in: xorg-server-21.1.19 and xwayland-24.1.9 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/99790a2c https://gitlab.freedesktop.org/xorg/xserver/-/commit/10c94238 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. 3) CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap() The XkbCompatMap structure stores some of its values using an unsigned short, but fails to check whether the sum of the input data might overflow the maximum unsigned short value. Introduced in: X11R6 Fixed in: xorg-server-21.1.19 and xwayland-24.1.9 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/475d9f49 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. https://lists.x.org/archives/xorg-announce/2025-October/003635.html Changelog: https://lists.x.org/archives/xorg/2025-October/062148.html Also update the COPYING hash for a change of copyright year. Signed-off-by: Raphael Pavlidis [Peter: Mark as security bump, extend commit message, fix COPYING hash] Signed-off-by: Peter Korsgaard (cherry picked from commit e11cac64a27d3be4a9cb7f1313276e6f386bb6e8) Signed-off-by: Thomas Perale --- package/x11r7/xwayland/xwayland.hash | 8 ++++---- package/x11r7/xwayland/xwayland.mk | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package/x11r7/xwayland/xwayland.hash b/package/x11r7/xwayland/xwayland.hash index 6cbbea8af5..0d1df29b43 100644 --- a/package/x11r7/xwayland/xwayland.hash +++ b/package/x11r7/xwayland/xwayland.hash @@ -1,6 +1,6 @@ -# From https://lists.x.org/archives/xorg/2025-June/062066.html -sha256 c8908d57c8ed9ceb8293c16ba7ad5af522efaf1ba7e51f9e4cf3c0774d199907 xwayland-24.1.8.tar.xz -sha512 b6dcc87f5c4d880cb23216518171a704c2a501803ac2efd9d01760895d755a617cd82313c6516f27a888b0581c64d74e3f8db5c238e1ae0d13da6cc1a547c02f xwayland-24.1.6.tar.xz +# From https://lists.x.org/archives/xorg/2025-October/062148.html +sha256 f297af27a84508db9b80d1cbbcc69c3801da38eb64c72f3b5b50f582459afdd0 xwayland-24.1.9.tar.xz +sha512 7438a572651dc77c1fd749879abccdc9a245c7b75143668d5561a8e99d41063f042a8eb3f9b931a2a12be1fc3cb9d197eee6794d0702a19e56c20f55acb35a26 xwayland-24.1.9.tar.xz # Locally calculated -sha256 4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f COPYING +sha256 abbb7969df55e399e91104ded4d0a20a1b67de7c01138e63d61b7ed4f81fec0d COPYING diff --git a/package/x11r7/xwayland/xwayland.mk b/package/x11r7/xwayland/xwayland.mk index e3b6727c19..59d607fb5b 100644 --- a/package/x11r7/xwayland/xwayland.mk +++ b/package/x11r7/xwayland/xwayland.mk @@ -4,7 +4,7 @@ # ################################################################################ -XWAYLAND_VERSION = 24.1.8 +XWAYLAND_VERSION = 24.1.9 XWAYLAND_SOURCE = xwayland-$(XWAYLAND_VERSION).tar.xz XWAYLAND_SITE = https://xorg.freedesktop.org/archive/individual/xserver XWAYLAND_LICENSE = MIT