From peter.hutterer at who-t.net Tue Apr 6 06:22:14 2021 From: peter.hutterer at who-t.net (Peter Hutterer) Date: Tue, 6 Apr 2021 16:22:14 +1000 Subject: [ANNOUNCE] xf86-input-libinput 1.0.0 Message-ID: xf86-input-libinput 1.0.0 is now available. I ran out of fingers counting past 30, hence the version bump to 1.0.0. The driver is now over 7 years old, we might as well pretend the semver has a meaning. The biggest change here is the license change to MIT. Due to an unfortunate copy/paste error, the actual license text used was the Historical Permission Notice and Disclaimer license. With the ack of the various contributors, the driver is now using the MIT license text as intended. The actual impact is low, the HPND is virtually identical to the MIT license anyway (ianal, consult your legal dept if you have one). The only other notable change: cancelled touch points are now lifted correctly. Where libinput cancels a touch, e.g. in response to a palm being detected, the touch point previously got stuck in the down state. This is fixed now. Dorian Stoll (1): Lift canceled touch inputs Peter Hutterer (6): Bump the libinput requirement to 1.11 Bump the server requirement to 1.19 to get rid of a bunch of ifdefs Switch to the real MIT license Remove trailing whitespaces gitlab CI: bump to use Fedora 33 xf86-input-libinput 1.0.0 Povilas Kanapickas (2): Remove unused btnmap variables Remove extraneous semicolon git tag: xf86-input-libinput-1.0.0 https://xorg.freedesktop.org/archive/individual/driver/xf86-input-libinput-1.0.0.tar.bz2 SHA256: ef55c2f66ae65da476c400205692ff77c9192bdc16fb3a285ea252267cf28a74 xf86-input-libinput-1.0.0.tar.bz2 SHA512: 8135afcdfd1d1bc8196c42680b2f3b3089ee25509776c52db4bdab0afca74d6ca1689a14b5e30a24834293d0377689138bd3ea4b249c9310d5ec5777ff3ebeb8 xf86-input-libinput-1.0.0.tar.bz2 PGP: https://xorg.freedesktop.org/archive/individual/driver/xf86-input-libinput-1.0.0.tar.bz2.sig https://xorg.freedesktop.org/archive/individual/driver/xf86-input-libinput-1.0.0.tar.gz SHA256: b764108813ad31858ed3baa50bb965f22f0e04dd56bd772abab8ae540a235959 xf86-input-libinput-1.0.0.tar.gz SHA512: 9f85b67e5fade475ca345dd4d51867d48e7454eae4775926a731b07b06d2e5089f71caa9eff90fad2e75b01866f2af1ba9bf4b27d6388d410a1f7556ca5afb37 xf86-input-libinput-1.0.0.tar.gz PGP: https://xorg.freedesktop.org/archive/individual/driver/xf86-input-libinput-1.0.0.tar.gz.sig -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 195 bytes Desc: not available URL: From matthieu at herrb.eu Tue Apr 13 14:02:29 2021 From: matthieu at herrb.eu (Matthieu Herrb) Date: Tue, 13 Apr 2021 16:02:29 +0200 Subject: X.Org server security advisory: April 13, 2021 Message-ID: X.Org server security advisory: April 13, 2021 Input validation failures in X server XInput extension ====================================================== Insufficient checks on the lengths of the XInput extension ChangeFeedbackControl request can lead to out of bounds memory accesses in the X server. These issues can lead to privilege escalation for authorized clients on systems where the X server is running privileged. * CVE-2021-3472 / ZDI CAN 12549 XChangeFeedbackControl Integer Underflow Patch ----- A patch for this issue has been committed to the xorg server git repository. xorg-server 1.20.11 and xwayland 21.1.1 will be released shortly and will include this patch. https://gitlab.freedesktop.org/xorg/xserver.git commit 7aaf54a1884f71dc363f0b884e57bcb67407a6cd Fix XChangeFeedbackControl() request underflow CVE-2021-3472 / ZDI-CAN-1259 Thanks ====== These vulnerabilities have been discovered by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. -- Matthieu Herrb -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: From mattst88 at gmail.com Tue Apr 13 14:21:01 2021 From: mattst88 at gmail.com (Matt Turner) Date: Tue, 13 Apr 2021 10:21:01 -0400 Subject: [ANNOUNCE] xorg-server 1.20.11 Message-ID: Christopher Chavez (1): XQuartz: recognize F16-F20 and Menu keys Fabrice Fontaine (1): meson.build: KMS support also depends on dri2 Jeremy Huddleston Sequoia (36): xquartz: Remove support for Panther and earlier versions of macOS os: Remove support for Tiger and earlier versions of macOS xquartz: Remove support for Tiger and earlier versions of macOS xquartz: Remove support for Leopard and earlier versions of macOS xquartz: Remove check for libdispatch now that we don't support pre-SnowLeopard xquartz: Remove support for SnowLeopard and earlier versions of macOS xquartz: Remove support for Lion and earlier versions of macOS xquartz: Remove support for Mountain Lion and earlier versions of macOS xquartz: Remove support for building for i386 xquartz: Remove unused include of AvailabilityMacros.h from various sources xquartz: Remove support for older versions of libXplugin xquartz: Ensure that NSRunAlertPanel() is run on the main thread xquartz: Ensure we call into TIS on the main thread xquartz: Update the about box copyright to 2021 xquartz: Apply Xcode 12.4 automatic updates to nibs xquartz: Fix applications menu table background color for dark mode xquartz: Apply spell check fixes from master for easier cherry-picking of changes in xquartz xquartz: Remove a workaround for AppKit versions older than Lion xquartz: Remove some dead code for compatibility with older nibs xquartz: Minor code modernization -- @autoreleasepool adoption xquartz: Use objc_autoreleasePoolPush / objc_autoreleasePoolPop directly in QuartzBlockHandler xqaurtz: Remove message_kit_thread() and use dispatch instead xquartz: Fold away array_with_strings_and_numbers and simplify with more modern Objective-C xquartz: Fold away some unnecessary hops to X11Controller through X11Application xquartz: Fold quartzCommon.h into quartz.h xquartz: Convert X11Application ivars into @properties xquartz: Convert X11Controller ivars into @properties xquartz: Rewrite Window menu handling to not depend on X11App.windowsMenu.numberOfItems being correct in -awakeFromNib xquartz: Silence a compiler warning about missing internal methods on NSApplication xquartz: Fix build with sparkle enabled xquartz: Fix a compiler warning about const incompatible pointer assignment xquartz: Allocate each fbconfig separately xquartz: Don't process AppKit events if we haven't finished initializing xquartz: Add a launch trampoline to better integrate with modern versions of macOS xquartz: Don't include strndup.c any more since we no longer support 10.8 and older xquartz: Remove a check for NSAppKitVersionNumber >= NSAppKitVersionNumber10_7 Jim DeLaHunt (1): Fix typo "XQaurtz" in Xquartz.man Jon Turney (1): xquartz: Add stub ddxInputThread() Mariusz Ceier (1): xwayland: Replace LogMessage with LogMessageVerb Matt Turner (1): xserver 1.20.11 Matthieu Herrb (1): Fix XChangeFeedbackControl() request underflow Michal Srb (1): xkb: Fix heap overflow caused by optimized away min. git tag: xorg-server-1.20.11 https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.20.11.tar.bz2 SHA256: 914c796e3ffabe1af48071d40ccc85e92117c97a9082ed1df29e4d64e3c34c49 xorg-server-1.20.11.tar.bz2 SHA512: 1017015b9fd5d53788abe3641d877e6df8609841fa5c1847c0a5e133ddcc1b758a5d695304ebd36828099ec201a85b6b70b46f5ea4f81c5bd3a16fa6e175e3c2 xorg-server-1.20.11.tar.bz2 PGP: https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.20.11.tar.bz2.sig https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.20.11.tar.gz SHA256: 4e9341c96f5ed0f6b9491ed732c501303479d3fe21da280c768a1822d7e5d352 xorg-server-1.20.11.tar.gz SHA512: 5a06d3c1406c1d896315a2ea030939c1c6b52abbf6d8489a31e060ba27795044e03ccc3607855586440a0df8660a18f84355c77ef030f81d765c9663bc9ac0df xorg-server-1.20.11.tar.gz PGP: https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.20.11.tar.gz.sig -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 636 bytes Desc: not available URL: From michel at daenzer.net Tue Apr 13 14:52:30 2021 From: michel at daenzer.net (=?UTF-8?Q?Michel_D=c3=a4nzer?=) Date: Tue, 13 Apr 2021 16:52:30 +0200 Subject: [ANNOUNCE] xwayland 21.1.1 Message-ID: <3a992464-6eee-581d-6731-458d936294b6@daenzer.net> The Xwayland 21.1.1 release contains just the fix for CVE-2021-3472 / ZDI-CAN-1259. Matthieu Herrb (1): Fix XChangeFeedbackControl() request underflow Michel D?nzer (1): Bump version for Xwayland 21.1.1 release git tag: xwayland-21.1.1 https://xorg.freedesktop.org/archive/individual/xserver/xwayland-21.1.1.tar.xz SHA256: 31f261ce51bbee76a6ca3ec02aa367ffa2b5efa2b98412df57ccefd7a19003ce xwayland-21.1.1.tar.xz SHA512: 0cb03d796af183f9fde14c30ef45d94ef466ac4ba3d85dda34e74f91dd94bb75d0c8a867ecb7bda7ea61d98c70a4f73bc98c5a205ea5f69a0e222cd780d263d8 xwayland-21.1.1.tar.xz PGP: https://xorg.freedesktop.org/archive/individual/xserver/xwayland-21.1.1.tar.xz.sig -- Earthling Michel D?nzer???????????????|???????????????https://redhat.com Libre software enthusiast?????????????|?????????????Mesa and X developer -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature Type: application/pgp-signature Size: 203 bytes Desc: OpenPGP digital signature URL: