-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 26 Oct 2026 19:58:16 +0100 Source: libxi Architecture: source Version: 2:1.8.4-1 Distribution: unstable Urgency: medium Maintainer: Debian X Strike Force <debian-x@lists.debian.org> Changed-By: Emilio Pozuelo Monfort <pochu@debian.org> Closes: 1148965 Changes: libxi (2:1.8.4-1) unstable; urgency=medium . * New upstream release (closes: #1148965) - CVE-2026-93541: OOB read in XQueryDeviceState(). - CVE-2026-93542: OOB read in XI2 class parsing via size_classes() and copy_classes(). - CVE-2026-93543: OOB read in XI2 class parser. - CVE-2026-93544: OOB read in XI2 XIQueryDevice reply parsing. - CVE-2026-93545: OOB read in XListInputDevices() - CVE-2026-94281: OOB read in XListInputDevices() class parsing. - CVE-2026-94282: OOB read in XI2 enter/leave/focus cookie conversion. - CVE-2026-109089: XGetDeviceControl Control Type Mismatch Heap Buffer Overflow - CVE-2026-109090: XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow * Update signing-key.asc. Checksums-Sha1: 955afc3526026fdf6b650a635140e6fbbfe9866f 2068 libxi_1.8.4-1.dsc 32de6d6cfabadf61eaff9d4460d0e38d48ba5da4 422212 libxi_1.8.4.orig.tar.xz 2570f8c99267e8f7d97d0744bf1f5df236188af7 23348 libxi_1.8.4-1.debian.tar.xz 72eb784e2e9ce99b2d2536910f03d4a306b44b77 6739 libxi_1.8.4-1_source.buildinfo Checksums-Sha256: 82025749283a2231866439499d86655c82f8154ae26d8b20ce1c18fe034f596f 2068 libxi_1.8.4-1.dsc ddd6057b89a91903bc2f884d55c8467440906945e482c36547260dff28661afc 422212 libxi_1.8.4.orig.tar.xz 9720c170c270c313be1c4422cc2ac8a1eb5872dbf943603a7f012a64f2bf1bff 23348 libxi_1.8.4-1.debian.tar.xz d3626a4d8a27a780d4b6f5ffbb163ce737677a681529a0fd8b72c3b7a2b85163 6739 libxi_1.8.4-1_source.buildinfo Files: 8fa7d575406005774cd1f6ba0c9003b4 2068 x11 optional libxi_1.8.4-1.dsc a3a7b2bb83b41ba278e5892a8352a469 422212 x11 optional libxi_1.8.4.orig.tar.xz 4e59214c7efbdd647113fe110b2e8fef 23348 x11 optional libxi_1.8.4-1.debian.tar.xz fa4d7ef93234c597a2c9425b604611c7 6739 x11 optional libxi_1.8.4-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmrgUqsACgkQnUbEiOQ2 gwJVAxAAj1gVcYodiV4XPaYrBpnPeM+MDSlAxAezzuwuaOs0T07ocF6i6stE+adb JzA4UVZmlE1K2ErMxJ91va/2tLt6DmAWHNJ8dly+fvgGGKGMPWuFbvCcn5Nt4ZIn ebW3QEAwTMOAwixIKHptwUKuAgyqodmq+Ms4fJBPTFYM7gCyDqpKvE/3Snp/HJ6n 9njyX1W9Ke6zKrWRDjlAztcv3xz6mo2zejIDQDtF2kwFMDFR45mbzdL5e191smLe N/DnGCl/vwN2pOCCmQ2hqkK4UFXho6jiRawGngNjtsr2zYRpxqEAZPL61M8m2ybQ Nw2S20iPd6OSS5RW7QWe7bLx1g3pQKtSPtd98Out3vdcYS/IQf0WJyFVLWoNvRPg YsELVI8kePLVSEXd5qtzOj9cwLs6l14GjrQZ995dZkW8GcckfVGt5S6pHxV6sUOU s+/p0iZX++cH0SZK6EG/l90DgzLXnXj/H8+wKQMo+EXrMCRPr4NOcAdscF2Rxpab QhuSmWiEazKXQtMS1che9blDxE1W7qQAcQAveQQqGBjReZVVOFYq6Aoj2LENyluE W0cSqr2vUB4vCjwKKHGXDrHw8aY8Bt1F18dVf4g2stErCpCAdfEgz8xqVXkHf7X1 KZsUzFPOmJVglkc6ZGPOduOlsA4m1ebWcgce5bhP/Pnr3n0W5/w= =NVJp -----END PGP SIGNATURE-----
