-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 10 Aug 2026 15:04:44 +0700 Source: xorg-server Architecture: source Version: 2:1.20.11-1+deb11u18 Distribution: bullseye-security Urgency: high Maintainer: Debian X Strike Force <debian-x@lists.debian.org> Changed-By: Arnaud Rebillout <arnaudr@debian.org> Closes: 1081338 1138680 Changes: xorg-server (2:1.20.11-1+deb11u18) bullseye-security; urgency=high . * Non-maintainer upload by the LTS Team. * dix: Hold input lock for AttachDevice() (CVE-2022-49737) (Closes: #1081338) * xkb: fix buffer re-use in _XkbSetCompatMap (CVE-2026-33999) * xkb: Fix bounds check in _CheckSetGeom() (CVE-2026-34000) * miext/sync: Fix use-after-free in miSyncTriggerFence() (CVE-2026-34001) * xkb: Fix out-of-bounds read in CheckModifierMap() (CVE-2026-34002) * xkb: Add additional bound checking in CheckKeyTypes() (CVE-2026-34003) * xkb: Add more _XkbCheckRequestBounds() (CVE-2026-34003) * sync: fix deletion of counters and fences (CVE-2026-50257, CVE-2026-50260) (Closes: #1138680) * sync: restart trigger list iteration in SyncChangeCounter after TriggerFired (CVE-2026-50261) (Closes: #1138680) * xkb: reject key types with num_levels exceeding XkbMaxShiftLevel (CVE-2026-50258) (Closes: #1138680) * xkb: clamp nMaps to mapWidths buffer size in CheckKeyTypes (CVE-2026-50259) (Closes: #1138680) * glx: fix reversed length check in ChangeDrawableAttributes (CVE-2026-50262) (Closes: #1138680) * saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow (CVE-2026-50263) (Closes: #1138680) * dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN (CVE-2026-50256) (Closes: #1138680) * dri2: Use booleans for (fake) front buffer tracking in do_get_buffers (CVE-2026-50264) (Closes: #1138680) * dri2: Deduplicate attachments in do_get_buffer (CVE-2026-50264) (Closes: #1138680) Checksums-Sha1: cd03a21d9d8085d3f30f3c45664826991e930622 4531 xorg-server_1.20.11-1+deb11u18.dsc 74c557593a9c403b6cddbd13c2225c14b55b4eff 229452 xorg-server_1.20.11-1+deb11u18.diff.gz 154c7f003d09d9f6a6663f51baf3113685473e3c 6840 xorg-server_1.20.11-1+deb11u18_source.buildinfo Checksums-Sha256: 12946f9b54d9b2025fc01faf2e3969fc3b2c67bb63d80ba29d73311d2ed5bd7e 4531 xorg-server_1.20.11-1+deb11u18.dsc 01da4c9f47ea3be5056bc3c27549827c5f58a8c2732535a7fd1f8969926024aa 229452 xorg-server_1.20.11-1+deb11u18.diff.gz 304a1c811ae2a224dcdc34dfa23f61cd4e4927d5d927d9c67ab22228447b15e6 6840 xorg-server_1.20.11-1+deb11u18_source.buildinfo Files: ce0d91d3ef60cfeb091673649ef763a3 4531 x11 optional xorg-server_1.20.11-1+deb11u18.dsc 1eb6c67bdaaacdff9490e651cfe9c5c1 229452 x11 optional xorg-server_1.20.11-1+deb11u18.diff.gz 1d6af6404a77e92d73ad369143d8582e 6840 x11 optional xorg-server_1.20.11-1+deb11u18_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJHBAEBCgAxFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmp9PM4THGFybmF1ZHJA ZGViaWFuLm9yZwAKCRDnJeh5FGACFiNWD/9Emut4wPF1iBOjKsqTQqMulK9sdY60 B+WE3w8ENsm65pZ8gr8Psh8S9pgOkdnZDkAINE4SMLHcZVB5/KnJ0fCuG8YbCBaV JjzyerQd5qUGjEEj9BPYEZ/nVWSngjy5ZKLpOWRtrrQLf0I+Pz1BuNuKlmMrc3+A fad4t6f1XzC45GOy+99aUJQrzHoyLW8FxDrgrHUCzxTxHjvZdkDsNix+xk23Mjxw gKGz438JLg5Bfk3Z5v9sbrRhAgVMm7zn7i07ta/F2UGqY3cUQJiTtoQzStkfaeiH qvNXwiROMEYvf3XY4OrhqZm1GcFzpTNkLZUzjepeeZlMowIQ8xf3YjGG34GHtWmE qJN2I8ofMmQJgQy2uezJqKXYjRX68aFR61ZrJ6MQ6isha8+CeMYv5q4UPOv4DMaH w1FRquABbAcdtdwCcneMDCCaZd6wRnvrvA2AksKAO+q1iK4eUHrkJWP9gXVxX3P+ MmqTnP0h4gmwmzw2kmajcRFBDNagxF9gsNny3gOvAshfM8gxNw3ZVbxSFWmd00M5 7O6A1JG2mQG87wZTmLEbYswB/aVxBlUkHENVoe+hSMmxwj5SEJ0Nfm/sQppE7tiK CUssbfLicChCqpv2Ao0Xt0fM8DgFXnh2Oc6cfQgUwjbPcTK2Udz6hZo2AHGKMX0d iknPYgAAO0699w== =aYZ9 -----END PGP SIGNATURE-----
