-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 09 Aug 2026 10:55:52 +0700 Source: xorg-server Architecture: source Version: 2:21.1.7-3+deb12u13 Distribution: bookworm-security Urgency: high Maintainer: Debian X Strike Force <debian-x@lists.debian.org> Changed-By: Arnaud Rebillout <arnaudr@debian.org> Closes: 1081338 1138680 Changes: xorg-server (2:21.1.7-3+deb12u13) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * dix: Hold input lock for AttachDevice() (CVE-2022-49737) (Closes: #1081338) * sync: fix deletion of counters and fences (CVE-2026-50257, CVE-2026-50260) (Closes: #1138680) * sync: restart trigger list iteration in SyncChangeCounter after TriggerFired (CVE-2026-50261) (Closes: #1138680) * xkb: reject key types with num_levels exceeding XkbMaxShiftLevel (CVE-2026-50258) (Closes: #1138680) * xkb: clamp nMaps to mapWidths buffer size in CheckKeyTypes (CVE-2026-50259) (Closes: #1138680) * glx: fix reversed length check in ChangeDrawableAttributes (CVE-2026-50262) (Closes: #1138680) * saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow (CVE-2026-50263) (Closes: #1138680) * dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN (CVE-2026-50256) (Closes: #1138680) * dri2: Use booleans for (fake) front buffer tracking in do_get_buffers (CVE-2026-50264) (Closes: #1138680) * dri2: Deduplicate attachments in do_get_buffer (CVE-2026-50264) (Closes: #1138680) Checksums-Sha1: c3660126b7e0a351b87d2fd464a5058039137e3a 4013 xorg-server_21.1.7-3+deb12u13.dsc 35628f1917963e440ff4e9604ceeddf97d0e9e38 221532 xorg-server_21.1.7-3+deb12u13.diff.gz ce2901e783d6b3e940659ed228d0e7ef10d84781 6836 xorg-server_21.1.7-3+deb12u13_source.buildinfo Checksums-Sha256: dbe8017d4ec9c987c0c7ab6f192bce6f9c13a70f2854431eca6890cb41c1a244 4013 xorg-server_21.1.7-3+deb12u13.dsc 2e2402de559cf20e3ba8c9f4e400b215749f29829adf291132d6e8f066b8a75e 221532 xorg-server_21.1.7-3+deb12u13.diff.gz 6f42691b882036ee2ed320a18d5009c05ccce2adf99595c75406837cc818b7d2 6836 xorg-server_21.1.7-3+deb12u13_source.buildinfo Files: 3c8b0feb81626f37e6daf7c875cf6345 4013 x11 optional xorg-server_21.1.7-3+deb12u13.dsc 4b8fcf8e04319a24a6c63a2f0c60be4d 221532 x11 optional xorg-server_21.1.7-3+deb12u13.diff.gz 2098e8516f97f06ad6a0ae87fb08aa87 6836 x11 optional xorg-server_21.1.7-3+deb12u13_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJHBAEBCgAxFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmp9PLUTHGFybmF1ZHJA ZGViaWFuLm9yZwAKCRDnJeh5FGACFpE9D/9XUZtxfvW9FG6aZ6YrPg/70N9N0V96 tFi2bFwEQ3mwDsKFaAc9At/rHpA4hKi7zLi5PKUykJsqjZ8Dh9LdaWKcVs3/9av/ JwEQNChw2UH/XhOC3le6y1MVtKt6rFXvl4IQ6UxK3SeRvOJB007CUC/rfrp/IB/C L8sSbAAJYuxnimdLedHWatE/e8vEH6RQjalTmHxaqzB8NQsz77umURrcRhfX1ptC Dwev8bT6ACT0KfVr4HUkko1IM6FeoV6Y0pnUsLCMCr8yUuL8SE0mtOmvgF/B3NcN GORcGA9+URw5Z6JkM5unUH1m6UVDW2blPJKpMBN3TAQNwdKmh3RCUEE0RcCHo/NN uHqEC5LP5zo7lgJms09nF+jP8A/JTk/gOK7FHrk7nzZ+64ROeTkc9Bnon0bWsxAe J5UJLtBK1J+IOBp2g3acdTpRGzvWD9p2Os+OZqQagj9YAJHa1GjA3flLK3FQyvX1 8F2N44O1nvYMOLhg7PKciY+6gFaRmz8/+J5olBnggro2Cc4Ke7jCd2pkenywDXSz cKlFqnnhf8hj9D/N2kLDWV5aFfx8HYTFfEOc1Vsg6U4ATlwPVRo4iVVnPawhD8gZ umCZsZk0RP3zj+v6IWtbkxK/aPhUbyxtp5jf1aQe0Ro+g94T918Sms39CcK9C7qr kQAETEZWeJjo7A== =gs64 -----END PGP SIGNATURE-----
