diff mbox series

[wrynose] libXi: upgrade 1.8.3 -> 1.8.4

Message ID 20261021070308.2984268-1-OmkarAbaji.Patil@windriver.com
State New
Headers show
Series [wrynose] libXi: upgrade 1.8.3 -> 1.8.4 | expand

Commit Message

Omkar Patil Oct. 21, 2026, 7:03 a.m. UTC 
Security and bug-fix point release;

Fixes the following CVEs:
*CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState().
*CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via size_classes()
                 and copy_classes().
*CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser.
*CVE-2026-93544: Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing.
*CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices().
*CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing.
*CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion.
*CVE-2026-109089: libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
*CVE-2026-109090: libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

Reference:
https://lists.x.org/archives/xorg-announce/2026-October/003752.html
https://lists.x.org/archives/xorg-announce/2026-October/003754.html

Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
---
 .../xorg-lib/{libxi_1.8.3.bb => libxi_1.8.4.bb}                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/xorg-lib/{libxi_1.8.3.bb => libxi_1.8.4.bb} (88%)
diff mbox series

Patch

diff --git a/meta/recipes-graphics/xorg-lib/libxi_1.8.3.bb b/meta/recipes-graphics/xorg-lib/libxi_1.8.4.bb
similarity index 88%
rename from meta/recipes-graphics/xorg-lib/libxi_1.8.3.bb
rename to meta/recipes-graphics/xorg-lib/libxi_1.8.4.bb
index 240215379f..fb89e3e526 100644
--- a/meta/recipes-graphics/xorg-lib/libxi_1.8.3.bb
+++ b/meta/recipes-graphics/xorg-lib/libxi_1.8.4.bb
@@ -18,6 +18,6 @@  PE = "1"
 XORG_PN = "libXi"
 XORG_EXT = "tar.xz"
 
-SRC_URI[sha256sum] = "7ad60056f01af4f786cfe93b3a7707447711626fc8da2637bec71a90409babe5"
+SRC_URI[sha256sum] = "ddd6057b89a91903bc2f884d55c8467440906945e482c36547260dff28661afc"
 
 BBCLASSEXTEND = "native nativesdk"