BSD Commit Log Search

   update

   xlock is setgid (auth), but does not use the bsd.prog.mk build infrastructure,
   so it needs manual definition of "mode_t _permit_setugid = S_ISGID". The other
   setgid program in X11R6 is xterm (group utmp), but it is built using bsd.prog.mk
   and automatically picks up the _permit_setugid variable.

   Update to makedepend 1.0.10

   Update to xwininfo 1.1.7

   Update to xpr 1.2.1

   Update to xmodmap 1.0.12

   update to xload 1.2.2

   Update to xkbprint 1.0.8

   Update to xfd 1.1.6

   regen

   Update to xclock 1.2.1

   update xclipboard do 1.1.6

   - Add the aarch64 NEON code
   - Remove use of ASM_HAVE_FUNC_DIRECTIVE. It is not relevant
     for sparc64. Clang on ARM does not support .func
   - Enable the GCC vector extensions and TLS on the other Clang
     archs
   diff from brad, ok miod@, kettenis@ for the arm64 part.

   update

   update

   Update to libpng 1.6.59.

   Update to xserver 21.1.25. Security fixes are already committed.

   Fixup previous

   As explained by matthieu@ the intent of this file is to track the latest
   version available *upstream*, not the version we have.  Here matthieu@
   plans to merge the full update to xserver-21.1.25 etc soon.

   Mention latest fixes merged from upstream xserver

   Mostly useful to trigger the git conversion process.
   Requested by tb@

   Merge fixes from upstream for Xserver issues:
   * CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
   * CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
   * CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
   * CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
   * CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
   * CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
   * CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
   * CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
   * CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
   * CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
   * CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
   * CVE-2026-93536: GestureBuildSprite Use-After-Free
   from matthieu@

   this is errata/7.9/032_xserver.patch.sig

   Merge fixes from upstream for Xserver issues:
   * CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
   * CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
   * CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
   * CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
   * CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
   * CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
   * CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
   * CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
   * CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
   * CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
   * CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
   * CVE-2026-93536: GestureBuildSprite Use-After-Free
   from matthieu@

   this is errata/7.8/068_xserver.patch.sig

   Merge fixes from upstream for Xserver issues:
   * CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
   * CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
   * CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
   * CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
   * CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
   * CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
   * CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
   * CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
   * CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
   * CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
   * CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
   * CVE-2026-93536: GestureBuildSprite Use-After-Free

   Do not close stdio file descriptors if built with -DDEBUG

   From Laurence Tratt a long time ago.

   Merge fixes from upstream for Xserver issues:
   * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)
   * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)

   Merge fixes from upstream for following issues:
   * BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)
   * PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)
   * computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

   from matthieu@

   this is errata/7.9/020_xserver.patch.sig

   Merge fixes from upstream for Xserver issues:
   * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)
   * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)

   Merge fixes from upstream for following issues:
   * BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)
   * PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)
   * computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

   from matthieu@

   this is errata/7.8/056_xserver.patch.sig

   small fixes, from Avon Robertson

   update

   Update to libXfont2 2.0.9

   font server code is disabled in xenocara, so OpenBSD is not affected
   by the security issues fixed in this release.

   zap two trailing tabs

   Convert imsg_get to imsgbuf_get.

   OK matthieu@ tb@