diff --git a/3RDPARTY b/3RDPARTY index 99e694ed..f21291db 100644 --- a/3RDPARTY +++ b/3RDPARTY @@ -1,27 +1,27 @@ -# $OpenBSD: 3RDPARTY,v 1.419 2023/11/02 06:09:39 jsg Exp $ +# $OpenBSD: 3RDPARTY,v 1.420 2024/01/05 07:05:51 matthieu Exp $ # Package: Freetype Version: 2.13.0 -Current Vers: 2.13.0 +Current Vers: 2.13.2 Maintainer: Freetype.org Archive Site: http://download.savannah.gnu.org/releases/freetype/ Package: xterm Version: 378 -Current Vers: 386 +Current Vers: 389 Maintainer: Thomas E. Dickey Archive Site: https://invisible-island.net/xterm/xterm.html Package: Mesa Version 23.1.9 -Current Vers: 23.2.1 +Current Vers: 23.3.2 Maintainer: Brian Paul Archive Site: https://archive.mesa3d.org/ Package: libdrm Version: 2.4.115 -Current Vers: 2.4.117 +Current Vers: 2.4.119 Maintainer: Freedesktop.org Archive Site: https://dri.freedesktop.org/libdrm/ @@ -39,7 +39,7 @@ Archive Site: https://github.com/anholt/libepoxy/releases Package: fontconfig Version: 2.14.2 -Current Vers: 2.14.2 +Current Vers: 2.15.0 Maintainer: Akira TAGOH Archive Site: https://www.fontconfig.org/ diff --git a/MODULES b/MODULES index 47a4d38b..c19a529c 100644 --- a/MODULES +++ b/MODULES @@ -1,4 +1,4 @@ -# $OpenBSD: MODULES,v 1.512 2023/10/29 17:29:07 matthieu Exp $ +# $OpenBSD: MODULES,v 1.513 2024/01/05 07:05:51 matthieu Exp $ # # X.Org maintained modules # @@ -182,7 +182,7 @@ lib/libxcvt 0.1.2 lib/libxkbfile 1.1.2 lib/libxshmfence 1.3.2 lib/libxtrans 1.5.0 -lib/pixman 0.42.2 +lib/pixman 0.43.0 lib/xcb-util 0.4.1 lib/xcb-util-cursor 0.1.5 needs-update lib/xcb-util-image 0.4.1 @@ -198,4 +198,4 @@ util/gccmakedep 1.0.3 util/macros 1.20.0 util/makedepend 1.0.8 -xserver 21.1.9 +xserver 21.1.10 diff --git a/app/xlockmore/etc/xlockmore.desktop b/app/xlockmore/etc/xlockmore.desktop old mode 100644 new mode 100755 diff --git a/app/xterm/uxterm.desktop b/app/xterm/uxterm.desktop old mode 100644 new mode 100755 diff --git a/app/xterm/xterm.desktop b/app/xterm/xterm.desktop old mode 100644 new mode 100755 diff --git a/xserver/ChangeLog b/xserver/ChangeLog index 082e971f..d067ec4d 100644 --- a/xserver/ChangeLog +++ b/xserver/ChangeLog @@ -1,3 +1,72 @@ +commit 15e2409776014b41c77f7da7aeb9520613994d27 +Author: Peter Hutterer +Date: Wed Dec 13 11:12:59 2023 +1000 + + xserver 21.1.10 + + Signed-off-by: Peter Hutterer + +commit a7bda3080d2b44eae668cdcec7a93095385b9652 +Author: Peter Hutterer +Date: Tue Nov 28 15:19:04 2023 +1000 + + Xi: allocate enough XkbActions for our buttons + + button->xkb_acts is supposed to be an array sufficiently large for all + our buttons, not just a single XkbActions struct. Allocating + insufficient memory here means when we memcpy() later in + XkbSetDeviceInfo we write into memory that wasn't ours to begin with, + leading to the usual security ooopsiedaisies. + + CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413 + + This vulnerability was discovered by: + Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + + (cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd) + +commit 58e83c683950ac9e253ab05dd7a13a8368b70a3c +Author: Peter Hutterer +Date: Mon Nov 27 16:27:49 2023 +1000 + + randr: avoid integer truncation in length check of ProcRRChange*Property + + Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty. + See also xserver@8f454b79 where this same bug was fixed for the core + protocol and XI. + + This fixes an OOB read and the resulting information disclosure. + + Length calculation for the request was clipped to a 32-bit integer. With + the correct stuff->nUnits value the expected request size was + truncated, passing the REQUEST_FIXED_SIZE check. + + The server then proceeded with reading at least stuff->num_items bytes + (depending on stuff->format) from the request and stuffing whatever it + finds into the property. In the process it would also allocate at least + stuff->nUnits bytes, i.e. 4GB. + + CVE-2023-6478, ZDI-CAN-22561 + + This vulnerability was discovered by: + Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + + (cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632) + +commit c1ad8df2fc570c482af832681260864b98c47791 +Author: nerdopolis +Date: Tue Jan 11 18:41:42 2022 -0500 + + xephyr: Don't check for SeatId anymore + + After a change for the xserver to automatically determine the seat + based on the XDG_SEAT variable, xephyr stopped working. This was + because of an old feature where xephyr used to handle evdev + directly. This was dropped some time ago, and now this check is + not needed + + (cherry picked from commit 4c03b67d334b05b814239420776f2fdd4c4a98ac) + commit 6197bea02eec072c19aa5365962e89949e674099 Author: Peter Hutterer Date: Wed Oct 25 11:05:28 2023 +1000 diff --git a/xserver/configure b/xserver/configure index 5cfc1d9e..73d34bb9 100644 --- a/xserver/configure +++ b/xserver/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for xorg-server 21.1.9. +# Generated by GNU Autoconf 2.71 for xorg-server 21.1.10. # # Report bugs to . # @@ -682,8 +682,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='xorg-server' PACKAGE_TARNAME='xorg-server' -PACKAGE_VERSION='21.1.9' -PACKAGE_STRING='xorg-server 21.1.9' +PACKAGE_VERSION='21.1.10' +PACKAGE_STRING='xorg-server 21.1.10' PACKAGE_BUGREPORT='https://gitlab.freedesktop.org/xorg/xserver/issues' PACKAGE_URL='' @@ -2015,7 +2015,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures xorg-server 21.1.9 to adapt to many kinds of systems. +\`configure' configures xorg-server 21.1.10 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -2086,7 +2086,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of xorg-server 21.1.9:";; + short | recursive ) echo "Configuration of xorg-server 21.1.10:";; esac cat <<\_ACEOF @@ -2275,10 +2275,10 @@ Optional Packages: org.x) --with-bundle-version=VERSION Version to use for X11.app's CFBundleVersion - (default: 21.1.9) + (default: 21.1.10) --with-bundle-version-string=VERSION Version to use for X11.app's - CFBundleShortVersionString (default: 21.1.9) + CFBundleShortVersionString (default: 21.1.10) --with-sparkle-feed-url=URL URL for the Sparkle feed (default: https://www.xquartz.org/releases/sparkle/release.xml) @@ -2493,7 +2493,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -xorg-server configure 21.1.9 +xorg-server configure 21.1.10 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -3150,7 +3150,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by xorg-server $as_me 21.1.9, which was +It was created by xorg-server $as_me 21.1.10, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3907,7 +3907,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $ ac_compiler_gnu=$ac_cv_c_compiler_gnu -RELEASE_DATE="2023-10-25" +RELEASE_DATE="2023-12-13" RELEASE_NAME="Caramel Ice Cream" @@ -4388,7 +4388,7 @@ fi # Define the identity of the package. PACKAGE='xorg-server' - VERSION='21.1.9' + VERSION='21.1.10' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -24439,7 +24439,7 @@ if test ${with_bundle_version+y} then : withval=$with_bundle_version; BUNDLE_VERSION="${withval}" else $as_nop - BUNDLE_VERSION="21.1.9" + BUNDLE_VERSION="21.1.10" fi @@ -33105,7 +33105,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by xorg-server $as_me 21.1.9, which was +This file was extended by xorg-server $as_me 21.1.10, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -33173,7 +33173,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -xorg-server config.status 21.1.9 +xorg-server config.status 21.1.10 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff --git a/xserver/configure.ac b/xserver/configure.ac index b882434b..d678ba95 100644 --- a/xserver/configure.ac +++ b/xserver/configure.ac @@ -26,8 +26,8 @@ dnl dnl Process this file with autoconf to create configure. AC_PREREQ(2.60) -AC_INIT([xorg-server], 21.1.9, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server) -RELEASE_DATE="2023-10-25" +AC_INIT([xorg-server], 21.1.10, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server) +RELEASE_DATE="2023-12-13" RELEASE_NAME="Caramel Ice Cream" AC_CONFIG_SRCDIR([Makefile.am]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/xserver/hw/kdrive/ephyr/ephyrinit.c b/xserver/hw/kdrive/ephyr/ephyrinit.c index 1a92b972..63a03111 100644 --- a/xserver/hw/kdrive/ephyr/ephyrinit.c +++ b/xserver/hw/kdrive/ephyr/ephyrinit.c @@ -70,25 +70,23 @@ InitInput(int argc, char **argv) KdKeyboardInfo *ki; KdPointerInfo *pi; - if (!SeatId) { - KdAddKeyboardDriver(&EphyrKeyboardDriver); - KdAddPointerDriver(&EphyrMouseDriver); + KdAddKeyboardDriver(&EphyrKeyboardDriver); + KdAddPointerDriver(&EphyrMouseDriver); - if (!kdHasKbd) { - ki = KdNewKeyboard(); - if (!ki) - FatalError("Couldn't create Xephyr keyboard\n"); - ki->driver = &EphyrKeyboardDriver; - KdAddKeyboard(ki); - } + if (!kdHasKbd) { + ki = KdNewKeyboard(); + if (!ki) + FatalError("Couldn't create Xephyr keyboard\n"); + ki->driver = &EphyrKeyboardDriver; + KdAddKeyboard(ki); + } - if (!kdHasPointer) { - pi = KdNewPointer(); - if (!pi) - FatalError("Couldn't create Xephyr pointer\n"); - pi->driver = &EphyrMouseDriver; - KdAddPointer(pi); - } + if (!kdHasPointer) { + pi = KdNewPointer(); + if (!pi) + FatalError("Couldn't create Xephyr pointer\n"); + pi->driver = &EphyrMouseDriver; + KdAddPointer(pi); } KdInitInput(); diff --git a/xserver/meson.build b/xserver/meson.build index e69c9140..5ffaed09 100644 --- a/xserver/meson.build +++ b/xserver/meson.build @@ -3,10 +3,10 @@ project('xserver', 'c', 'buildtype=debugoptimized', 'c_std=gnu99', ], - version: '21.1.9', + version: '21.1.10', meson_version: '>= 0.47.0', ) -release_date = '2023-10-25' +release_date = '2023-12-13' add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc']) cc = meson.get_compiler('c')