This release contains the fixes for the issues reported in today's security advisory:
https://lists.x.org/archives/xorg-announce/2026-June/003702.html - Font Alias Stack-based Buffer Overflow - XSYNC Use-After-Free in miSyncDestroyFence() - XKB Key Types Stack-based Buffer Overflow - XKB SetMap Request Stack-based Buffer Overflow - XSYNC Use-After-Free in FreeCounter() - XSYNC Use-After-Free in SyncChangeCounter() - GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write - CreateSaverWindow Use-After-Free Information Disclosure - DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write Additionally, it contains a number of other various fixes from the stable xserver-21.1-branch. Eli Schwartz (1): meson: fix types for some build options Michel Dänzer (2): dri2: Use booleans for (fake) front buffer tracking in do_get_buffers dri2: Deduplicate attachments in do_get_buffer Mikhail Dmitrichenko (2): xkb: fix incorrect size check when growing doodads in a section xkb: fix potential buff overflow in XkbVModIndexText for XkbCFile format Peter Hutterer (15): Xi: add missing gesture grab type checks in ProcXIPassiveUngrabDevice xkb: Fix out-of-bounds array access in _CheckSetShapes() xkb: Fix off-by-one in color index validation in _CheckSetGeom() xkb: Fix off-by-one and NULL dereferences in _CheckSetOverlay() xkb: Add bounds check for action data in CheckKeyActions() present: actually return the created notifies glx: reject negative size in FeedbackBuffer and SelectBuffer requests sync: fix deletion of counters and fences sync: restart trigger list iteration in SyncChangeCounter after TriggerFired xkb: reject key types with num_levels exceeding XkbMaxShiftLevel xkb: clamp nMaps to mapWidths buffer size in CheckKeyTypes glx: fix reversed length check in ChangeDrawableAttributes saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN xserver 21.1.23 git tag: xorg-server-21.1.23 https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.23.tar.gz SHA256: d81f4bea5eaf7e5c299bfeb52d54bab7e17ea72997b10fc9907712fccf9a64d5 xorg-server-21.1.23.tar.gz SHA512: a63754851254e4b0068716fab7829834a63d09620fd4d280d39a444d5e9ad0301e7e66eb2fa78699623796a2fbf54fc6b9b6df5865a9e4d220309e91585a1404 xorg-server-21.1.23.tar.gz PGP: https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.23.tar.gz.sig https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.23.tar.xz SHA256: e39832e5617dadaf072fdf9f0e19e5d2e1c2a13607ac280bac1aba9f8fe14634 xorg-server-21.1.23.tar.xz SHA512: 7eae854af1b5db1f5d1e59cb9d26b86d98fa176d4f80f70935c707f17982d0446a0a8ad8d29c922edbd208435f995b027604fbb72e62a7bf3ba79f2f570aa0bb xorg-server-21.1.23.tar.xz PGP: https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.23.tar.xz.sig
signature.asc
Description: PGP signature
