xorg-server (2:21.1.12-1ubuntu1.5) noble-security; urgency=medium

  * SECURITY UPDATE: Use-after-free in XPresentNotify structures creation
    - debian/patches/CVE-2025-62229.patch: fix use-after-free in
      present/present_notify.c.
    - CVE-2025-62229
  * SECURITY UPDATE: Use-after-free in Xkb client resource removal
    - debian/patches/CVE-2025-62230-1.patch: make the RT_XKBCLIENT resource
      private in xkb/xkb.c, include/xkbsrv.h.
    - debian/patches/CVE-2025-62230-2.patch: free the XKB resource when
      freeing XkbInterest in xkb/xkbEvents.c.
    - CVE-2025-62230
  * SECURITY UPDATE: Value overflow in Xkb extension XkbSetCompatMap()
    - debian/patches/CVE-2025-62231.patch: prevent overflow in xkb/xkb.c.
    - CVE-2025-62231

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Oct 2025 13:29:50 -0400

xorg-server (2:21.1.12-1ubuntu1.4) noble-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds access in X Rendering extension
    - debian/patches/CVE-2025-49175.patch: avoid 0 or less animated cursors
      in render/animcur.c, render/render.c.
    - CVE-2025-49175
  * SECURITY UPDATE: Integer overflow in Big Requests Extension
    - debian/patches/CVE-2025-49176.patch: do not overflow the integer size
      with BigRequest in dix/dispatch.c, os/io.c.
    - CVE-2025-49176
  * SECURITY UPDATE: Data leak in XFIXES Extension 6
    - debian/patches/CVE-2025-49177.patch: check request length for
      SetClientDisconnectMode in xfixes/disconnect.c.
    - CVE-2025-49177
  * SECURITY UPDATE: Unprocessed client request via bytes to ignore
    - debian/patches/CVE-2025-49178.patch: account for bytes to ignore when
      sharing input buffer in os/io.c.
    - CVE-2025-49178
  * SECURITY UPDATE: Integer overflow in X Record extension
    - debian/patches/CVE-2025-49179.patch: check for overflow in
      RecordSanityCheckRegisterClients() in record/record.c.
    - CVE-2025-49179
  * SECURITY UPDATE: Integer overflow in RandR extension
    - debian/patches/CVE-2025-49180-1.patch: check for overflow in
      RRChangeProviderProperty() in randr/rrproviderproperty.c.
    - debian/patches/CVE-2025-49180-2.patch: check for RandR provider
      functions in hw/xfree86/modes/xf86RandR12.c.
    - CVE-2025-49180

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Jun 2025 14:21:45 -0400

xorg-server (2:21.1.12-1ubuntu1.3) noble; urgency=medium

  * If a client application has not called DRI2ScreenInit(), 
    DRI2Authenticate() and DRI2CreateDrawable2() cause the X server to
    crash. This patch adds some sanity checks to ensure the X server
    stays running. (LP: #1861609)
    - d/p/lp1861609-dri2-Protect-against-dri2ClientPrivate-assertio.patch

 -- Matthew Ruffell <matthew.ruffell@canonical.com>  Tue, 04 Mar 2025 17:58:03 +1300

xorg-server (2:21.1.12-1ubuntu1.2) noble-security; urgency=medium

  * SECURITY UPDATE: Use-after-free of the root cursor
    - debian/patches/CVE-2025-26594-1.patch: refuse to free the root cursor
      in dix/dispatch.c.
    - debian/patches/CVE-2025-26594-2.patch: keep a ref to the rootCursor
      in dix/main.c.
    - CVE-2025-26594
  * SECURITY UPDATE: Buffer overflow in XkbVModMaskText()
    - debian/patches/CVE-2025-26595.patch: fix bounds check in
      xkb/xkbtext.c.
    - CVE-2025-26595
  * SECURITY UPDATE: Heap overflow in XkbWriteKeySyms()
    - debian/patches/CVE-2025-26596.patch: fix computation of
      XkbSizeKeySyms in xkb/xkb.c.
    - CVE-2025-26596
  * SECURITY UPDATE: Buffer overflow in XkbChangeTypesOfKey()
    - debian/patches/CVE-2025-26597.patch: also resize key actions in
      xkb/XKBMisc.c.
    - CVE-2025-26597
  * SECURITY UPDATE: Out-of-bounds write in CreatePointerBarrierClient()
    - debian/patches/CVE-2025-26598.patch: fix barrier device search in
      Xi/xibarriers.c.
    - CVE-2025-26598
  * SECURITY UPDATE: Use of uninitialized pointer in compRedirectWindow()
    - debian/patches/CVE-2025-26599-1.patch: handle failure to redirect in
      composite/compalloc.c.
    - debian/patches/CVE-2025-26599-2.patch: initialize border clip even
      when pixmap alloc fails in composite/compalloc.c.
    - CVE-2025-26599
  * SECURITY UPDATE: Use-after-free in PlayReleasedEvents()
    - debian/patches/CVE-2025-26600.patch: dequeue pending events on frozen
      device on removal in dix/devices.c.
    - CVE-2025-26600
  * SECURITY UPDATE: Use-after-free in SyncInitTrigger()
    - debian/patches/CVE-2025-26601-1.patch: do not let sync objects
      uninitialized in Xext/sync.c.
    - debian/patches/CVE-2025-26601-2.patch: check values before applying
      changes in Xext/sync.c.
    - debian/patches/CVE-2025-26601-3.patch: do not fail
      SyncAddTriggerToSyncObject() in Xext/sync.c.
    - debian/patches/CVE-2025-26601-4.patch: apply changes last in
      SyncChangeAlarmAttributes() in Xext/sync.c.
    - CVE-2025-26601

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Feb 2025 08:44:27 -0500

xorg-server (2:21.1.12-1ubuntu1.1) noble-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer overflow in _XkbSetCompatMap
    - debian/patches/CVE-2024-9632.patch: properly update size in
      xkb/xkb.c.
    - CVE-2024-9632

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 11 Oct 2024 10:21:58 -0400

xorg-server (2:21.1.12-1ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 12 Apr 2024 12:10:06 +0300

xorg-server (2:21.1.12-1) unstable; urgency=medium

  * New upstream release.
  * render: Avoid possible double-free in ProcRenderAddGlyphs()
    (closes: #1068470)

 -- Julien Cristau <jcristau@debian.org>  Wed, 10 Apr 2024 10:44:55 +0200

xorg-server (2:21.1.11-3) unstable; urgency=high

  [ Chris Hofstaedtler ]
  * Use udev.pc to place udev files (Closes: #1057945)

  [ Julien Cristau ]
  * Pull from upstream server-21.1-branch:
    - hw/xfree86: fix NULL pointer refrence to mode name
    - Initialize Mode->name in xf86CVTMode()
    - Allow disabling byte-swapped clients
    - Xext: SProcSyncCreateFence needs to swap drawable id too
    - Xi: ProcXIGetSelectedEvents needs to use unswapped length to send
      reply (CVE-2024-31080)
    - Xi: ProcXIPassiveGrabDevice needs to use unswapped length to send
      reply (CVE-2024-31081)
    - Xquartz: ProcAppleDRICreatePixmap needs to use unswapped length to
      send reply (CVE-2024-31082)
    - render: fix refcounting of glyphs during ProcRenderAddGlyphs
      (CVE-2024-31083)
  * dix-Fix-use-after-free-in-input-device-shutdown.patch: drop (now upstream).

 -- Julien Cristau <jcristau@debian.org>  Wed, 03 Apr 2024 21:09:12 +0200

xorg-server (2:21.1.11-2ubuntu2) noble; urgency=medium

  * d/p/fix-suspend-resume-with-no-input-device.patch (LP: #2056331)
    - Make sure info->active and info->vt_active are false
      after dropping drm master.
    - Normally, this is done when pausing the first
      input device, so it breaks when there are no
      input device at all.

 -- Talha Can Havadar <talha.can.havadar@canonical.com>  Wed, 07 Mar 2024 16:29:06 +0900

xorg-server (2:21.1.11-2ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 23 Jan 2024 16:01:48 +0200

xorg-server (2:21.1.11-2) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * dix: Fix use after free in input device shutdown (Closes: #1061110)

 -- Julien Cristau <jcristau@debian.org>  Mon, 22 Jan 2024 13:17:07 +0100

xorg-server (2:21.1.11-1ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 18 Jan 2024 17:38:50 +0200

xorg-server (2:21.1.11-1) unstable; urgency=medium

  * New upstream release, fixes:
    - CVE-2023-6816
    - CVE-2024-0229
    - CVE-2024-21885
    - CVE-2024-21886
    - CVE-2024-0408
    - CVE-2024-0409

 -- Julien Cristau <jcristau@debian.org>  Tue, 16 Jan 2024 15:33:53 +0100

xorg-server (2:21.1.10-1ubuntu1) noble; urgency=medium

  * Merge from Debian.
    - Drop upstreamed patches

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 10:18:49 +0200

xorg-server (2:21.1.10-1) unstable; urgency=medium

  [ Emilio Pozuelo Monfort ]
  * Fix build on hurd-amd64. Thanks Samuel Thibault. (Closes: #1055412)

  [ Timo Aaltonen ]
  * New upstream release.
    - CVE-2023-6377
    - CVE-2023-6478

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 09:51:20 +0200

xorg-server (2:21.1.9-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-5367
    - CVE-2023-5380
    - CVE-2023-5574

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Oct 2023 10:43:00 +0300

xorg-server (2:21.1.8-1) unstable; urgency=medium

  * patches: Drop an obsolete patch. (Closes: #1034413)
  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 01 Aug 2023 12:26:02 +0300

xorg-server (2:21.1.7-3ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
    RRChangeOutputProperty
    - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
      and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
    - CVE-2023-5367
  * SECURITY UPDATE: Use-after-free bug in DestroyWindow
    - debian/patches/CVE-2023-5380.patch: reset the PointerWindows
      reference on screen switch in dix/enterleave.h, include/eventstr.h,
      mi/mipointer.c.
    - CVE-2023-5380

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 23 Oct 2023 12:20:07 -0400

xorg-server (2:21.1.7-3ubuntu2) mantic; urgency=medium

  * Remove reverse-applicable CVE-2023-1393.patch.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 26 Jul 2023 13:20:42 -0500

xorg-server (2:21.1.7-3ubuntu1) mantic; urgency=medium

  * Merge from Debian.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 26 Jul 2023 13:06:51 -0500

xorg-server (2:21.1.7-3) unstable; urgency=medium

  * Enable DRI2 for the udeb build, needed in addition to DRM support
    since 9c81b8f5b5 to build the modesetting driver. This fixes failures
    to start X in the graphical installer under UTM (Closes: #1035014).
    Thanks to Keith Toh for the report and the follow-up tests!

 -- Cyril Brulebois <kibi@debian.org>  Wed, 03 May 2023 03:41:41 +0200

xorg-server (2:21.1.7-2) unstable; urgency=high

  * composite: Fix use-after-free of the COW
    ZDI-CAN-19866/CVE-2023-1393

 -- Julien Cristau <jcristau@debian.org>  Wed, 29 Mar 2023 15:11:07 +0200

xorg-server (2:21.1.7-1ubuntu3) lunar; urgency=medium

  * SECURITY UPDATE: Overlay Window Use-After-Free
    - debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in
      composite/compwindow.c.
    - CVE-2023-1393

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 31 Mar 2023 12:53:56 -0400

xorg-server (2:21.1.7-1ubuntu2) lunar; urgency=medium

  * patches: Force update LEDs after device state update. (LP: #1993621)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 21 Feb 2023 17:08:20 +0200

xorg-server (2:21.1.7-1ubuntu1) lunar; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 08 Feb 2023 15:51:43 +0200

xorg-server (2:21.1.7-1) unstable; urgency=medium

  * New upstream release
    + Xi: fix potential use-after-free in DeepCopyPointerClasses
      (CVE-2023-0494, closes: #1030777)

 -- Julien Cristau <jcristau@debian.org>  Tue, 07 Feb 2023 14:15:45 +0100

xorg-server (2:21.1.6-1ubuntu1) lunar; urgency=medium

  * Merge from Debian.
  * re-calculate-the-clock-and-refresh-rate.diff: Replace with a newer
    version.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 05 Jan 2023 16:11:27 +0200

xorg-server (2:21.1.6-1) unstable; urgency=medium

  * New upstream release.
  * patches: Drop upstreamed patches.
  * Add signing-key from Olivier Fourdan.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 05 Jan 2023 16:02:46 +0200

xorg-server (2:21.1.5-1ubuntu1) lunar; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Dec 2022 11:17:57 +0200

xorg-server (2:21.1.5-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-46340, CVE-2022-46341, CVE-2022-46342, CVE-2022-46343,
      CVE-2022-46344, CVE-2022-46283
  * Add signing-key from Peter Hutterer.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Dec 2022 11:10:24 +0200

xorg-server (2:21.1.4-3ubuntu2) lunar; urgency=medium

  * re-calculate-the-clock-and-refresh-rate.diff: Import v2, fix a
    crash. (LP: #1999008)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 07 Dec 2022 11:21:17 +0200

xorg-server (2:21.1.4-3ubuntu1) lunar; urgency=medium

  * Merge from Debian.
  * re-calculate-the-clock-and-refresh-rate.diff: Fix modes on 2.5k@90Hz
    panels. (LP: #1996490)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 14 Nov 2022 09:53:38 +0200

xorg-server (2:21.1.4-3) unstable; urgency=medium

  * xkb: proof GetCountedString against request length attacks (CVE-2022-3550)
  * xkb: fix some possible memleaks in XkbGetKbdByName (CVE-2022-3551)

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Fri, 11 Nov 2022 13:35:13 +0100

xorg-server (2:21.1.4-2ubuntu1) kinetic; urgency=medium

  * Merge from Debian.
  * Drop CVE patches, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Sep 2022 12:59:30 +0300

xorg-server (2:21.1.4-2) unstable; urgency=medium

  * 001_fedora_extramodes.patch: Dropped, apparently obsolete since
    1.5.0. (LP: #1990456)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 22 Sep 2022 08:53:59 +0300

xorg-server (2:21.1.4-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-2319, CVE-2022-2320 (Closes: #1014903)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 25 Jul 2022 12:46:43 +0300

xorg-server (2:21.1.3-2ubuntu3) kinetic; urgency=medium

  * SECURITY UPDATE: ProcXkbSetGeometry Out-Of-Bounds Access
    - debian/patches/CVE-2022-2319-pre1.patch: switch to array index loops
      to moving pointers in xkb/xkb.c.
    - debian/patches/CVE-2022-2319.patch: add request length validation for
      XkbSetGeometry in xkb/xkb.c.
    - CVE-2022-2319
  * SECURITY UPDATE: ProcXkbSetDeviceInfo Out-Of-Bounds Access
    - debian/patches/CVE-2022-2320.patch: swap XkbSetDeviceInfo and
      XkbSetDeviceInfoCheck in xkb/xkb.c.
    - CVE-2022-2320

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 06 Jul 2022 09:45:33 -0400

xorg-server (2:21.1.3-2ubuntu2) jammy; urgency=medium

  * rules: Drop special case for i386, dmx is gone.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 01 Mar 2022 16:33:35 +0200

xorg-server (2:21.1.3-2ubuntu1) jammy; urgency=medium

  * Merge from Debian.
  * patches: Drop upstreamed patches.
  * patches: Refreshed.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 23 Feb 2022 17:20:53 +0200

xorg-server (2:21.1.3-2) unstable; urgency=medium

  * present-Check-for-NULL-to-prevent-crash.patch: Fix a crash with
    nvidia 495.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 09 Feb 2022 12:19:09 +0200

xorg-server (2:21.1.3-1) experimental; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 10 Jan 2022 17:54:12 +0200

xorg-server (2:21.1.1-2) experimental; urgency=medium

  * Fix serverminver.
  * control: Add libxcvt-dev to xserver-xorg-dev depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 27 Nov 2021 11:18:56 +0200

xorg-server (2:21.1.1-1) experimental; urgency=medium

  * New upstream release.
  * 04_compiler_h_inb_outb_mips.diff: Dropped, upstream.
  * Xwayland is dropped from this souce, don't try to build it.
  * Xdmx is gone, drop it from the build.
  * serverminver: Bump versions.
  * control: Bump x11proto-dev and libx1-dev depends.
  * control: Add libxcvt-dev to build-depends, xcvt to -core Recommends.
  * control: Bump libdrm-dev build-depends.
  * Update signing-key.asc.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Nov 2021 16:31:46 +0200

xorg-server (2:1.20.14-1ubuntu1) jammy; urgency=medium

  * Merge from Debian.
  * CVE patches dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 11 Jan 2022 16:51:48 +0200

xorg-server (2:1.20.14-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 11 Jan 2022 16:21:08 +0200

xorg-server (2:1.20.13-3) unstable; urgency=high

  * Team upload.
  * record: Fix out of bounds access in SwapCreateRegister() [CVE-2021-4011]
  * xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() [CVE-2021-4009]
  * Xext: Fix out of bounds access in SProcScreenSaverSuspend() [CVE-2021-4010]
  * render: Fix out of bounds access in SProcRenderCompositeGlyphs() [CVE-2021-4008]

 -- Julien Cristau <jcristau@debian.org>  Tue, 14 Dec 2021 14:38:21 +0100

xorg-server (2:1.20.13-2) unstable; urgency=medium

  * Upload to unstable.
  * Disable building xwayland.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 27 Nov 2021 13:03:35 +0200

xorg-server (2:1.20.13-1ubuntu2) jammy; urgency=medium

  * SECURITY UPDATE: SProcRenderCompositeGlyphs out-of-bounds access
    - debian/patches/CVE-2021-4008.patch: check lengths in render/render.c.
    - CVE-2021-4008
  * SECURITY UPDATE: SProcXFixesCreatePointerBarrier out-of-bounds access
    - debian/patches/CVE-2021-4009.patch: use sizes in xfixes/cursor.c.
    - CVE-2021-4009
  * SECURITY UPDATE: SProcScreenSaverSuspend out-of-bounds access
    - debian/patches/CVE-2021-4010.patch: fix logic in Xext/saver.c.
    - CVE-2021-4010
  * SECURITY UPDATE: SwapCreateRegister out-of-bounds access
    - debian/patches/CVE-2021-4011.patch: fix length in record/record.c.
    - CVE-2021-4011

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 14 Dec 2021 11:11:36 -0500

xorg-server (2:1.20.13-1ubuntu1) impish; urgency=medium

  * Merge from Debian.
  * modesetting-disable-reverse-prime-offload-udl.diff: Dropped,
    upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 Aug 2021 12:32:48 +0300

xorg-server (2:1.20.13-1) experimental; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 Aug 2021 12:27:00 +0300

xorg-server (2:1.20.11-1ubuntu2) impish; urgency=medium

  * modesetting-disable-reverse-prime-offload-udl.diff: Fix a regression
    on displaylink devices after mesa update. (LP: #1931547)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 06 Jul 2021 13:17:51 +0300

xorg-server (2:1.20.11-1ubuntu1) hirsute; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 13 Apr 2021 19:15:17 +0300

xorg-server (2:1.20.11-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2021-3472
  * Add signing key for Matt Turner.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 13 Apr 2021 19:07:31 +0300

xorg-server (2:1.20.10-3ubuntu7) hirsute; urgency=medium

  * 300-mi-sprite-SaveUnderCursor2.patch: Drop duplicate entries.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 09 Apr 2021 13:30:53 +0300

xorg-server (2:1.20.10-3ubuntu6) hirsute; urgency=medium

  * 300-mi-sprite-SaveUnderCursor2.patch: Fix cursor bleeding issue
    (LP: #1911479).
    The new function, miDCSaveUnderCursor2, is required by Xilinx armsoc driver

 -- Ethan Hsieh <ethan.hsieh@canonical.com>  Fri, 19 Mar 2021 12:55:11 +0000

xorg-server (2:1.20.10-3ubuntu5) hirsute; urgency=medium

  * Disable building xwayland.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 26 Mar 2021 15:16:17 +0200

xorg-server (2:1.20.10-3ubuntu4) hirsute; urgency=medium

  * Disable building with lto, it's a 20+GB link not yet investigated.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 26 Mar 2021 13:37:55 +0100

xorg-server (2:1.20.10-3ubuntu3) hirsute; urgency=medium

  * Stop building the udeb on request.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 22 Feb 2021 11:54:42 +0100

xorg-server (2:1.20.10-3ubuntu1) hirsute; urgency=medium

  * Merge from Debian.
  * patches: Drop upstreamed patches.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Feb 2021 12:30:29 +0200

xorg-server (2:1.20.10-3) unstable; urgency=medium

  [ Julien Cristau ]
  * Drop workaround for mips* FTBFS added in 2:1.20.10-1, shouldn't be
    necessary anymore with the change in 2:1.20.10-2.

  [ Sven Joachim ]
  * Recommend default-logind | logind rather than libpam-systemd in
    xserver-xorg-core (Closes: #923198).
  * Use mktemp rather than tempfile in xserver-xorg-legacy.postinst
    (Closes: #979751).
  * Use dpkg-vendor to get the vendor name, drop lsb-release from
    Build-Depends.

   [ Vagrant Cascadian ]
  * Avoid embedding the running kernel version (Closes: #976898).

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Feb 2021 11:17:43 +0200

xorg-server (2:1.20.10-2) unstable; urgency=medium

  * Stop defining inb/outb on mips, to fix FTBFS in some drivers with GCC 10
    (closes: #978670).

 -- Julien Cristau <jcristau@debian.org>  Wed, 06 Jan 2021 10:33:33 +0100

xorg-server (2:1.20.10-1) unstable; urgency=medium

  [ Timo Aaltonen ]
  * New upstream release.
    - CVE-2020-14360, CVE-2020-25712 (Closes: #976216)
  * Drop patches:
    - 0001-Revert-*: Reverted upstream in this version
    - revert-hw-xfree86-avoid-cursor-use-after-free.diff: Issue fixed in this version
    - revert-disabling-xss-for-rootless-xwayland.diff: Was resolved upstream as
      being a client bug
  * control: Add libnvidia-egl-wayland-dev to build-depends, enables
    EGLStream support in xwayland.

  [ Adrian Bunk ]
  * rules: Add a workaround to fix build on mips*. (Closes: #975579)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 02 Dec 2020 12:41:35 +0200

xorg-server (2:1.20.9-2ubuntu3) hirsute; urgency=medium

  * SECURITY UPDATE: out of bounds memory accesses on too short request
    - debian/patches/CVE-2020-14360.patch: check SetMap request length
      carefully in xkb/xkb.c.
    - CVE-2020-14360
  * SECURITY UPDATE: multiple heap overflows
    - debian/patches/CVE-2020-25712.patch: add bounds checks in xkb/xkb.c.
    - CVE-2020-25712

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Dec 2020 09:16:47 -0500

xorg-server (2:1.20.9-2ubuntu2) hirsute; urgency=medium

  * fix-gtf-detection-for-edid-14.diff: Fix a regression in detecting
    modes of an EDID 1.4 monitor. (LP: #1897530)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 30 Nov 2020 13:53:47 +0200

xorg-server (2:1.20.9-2ubuntu1) groovy; urgency=medium

  * Merge from Debian.
    - xfree86-add-drm-modes-on-non-GTF-panels.patch: Dropped, upstream
    - CVE patches dropped, upstream
  * modesetting-do-not-stop-on-entervt.diff: Dropped in favor of two
    upstream commits that got merged. (LP: #1897530)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 07 Oct 2020 08:46:52 +0300

xorg-server (2:1.20.9-2) unstable; urgency=medium

  * fix-pci-probing-segfault.diff: Dropped and revert three commits
    instead. (Closes: #969739)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 24 Sep 2020 12:19:06 +0300

xorg-server (2:1.20.9-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2020-14347 (Closes: #968986)
  * fix-pci-probing-segfault.diff: Fix a regression in 1.20.9 when
    probing the GPU.
  * revert-hw-xfree86-avoid-cursor-use-after-free.diff: Revert a commit
    which is causing server crashes.
  * revert-disabling-xss-for-rootless-xwayland.diff: Fix a regression
    where apps crash under Xwayland.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 31 Aug 2020 18:49:48 +0300

xorg-server (2:1.20.8-2ubuntu6) groovy; urgency=medium

  * SECURITY UPDATE: Out-Of-Bounds access in XkbSetNames function
    - debian/patches/CVE-2020-14345.patch: correct bounds checking in
      xkb/xkb.c.
    - CVE-2020-14345

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 04 Sep 2020 09:32:36 -0400

xorg-server (2:1.20.8-2ubuntu5) groovy; urgency=medium

  * SECURITY UPDATE: Integer underflow in the X input extension protocol
    - debian/patches/CVE-2020-14346.patch: properly calculate length in
      Xi/xichangehierarchy.c.
    - CVE-2020-14346
  * SECURITY UPDATE: server memory leak
    - debian/patches/CVE-2020-14347.patch: initialize memory in
      dix/pixmap.c.
    - CVE-2020-14347
  * SECURITY UPDATE: Integer Underflow Privilege Escalation
    - debian/patches/CVE-2020-14361.patch: fix dataLeft calculation in
      xkb/xkbSwap.c.
    - CVE-2020-14361
  * SECURITY UPDATE: Integer Underflow Privilege Escalation
    - debian/patches/CVE-2020-14362.patch: properly calculate lengths in
      record/record.c.
    - CVE-2020-14362
  * debian/control: add libffi-dev to Build-Depends to fix FTBFS.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Sep 2020 09:55:00 -0400

xorg-server (2:1.20.8-2ubuntu4) groovy; urgency=medium

  * xfree86-add-drm-modes-on-non-GTF-panels.patch: Add GTF modes on
    continuous-frequency monitors. (LP: #1883497)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 24 Jun 2020 08:50:33 +0300

xorg-server (2:1.20.8-2ubuntu3) groovy; urgency=medium

  * modesetting-do-not-stop-on-entervt.diff: Don't crash if connectors
    go missing. (LP: #1879893)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 21 May 2020 11:22:15 +0300

xorg-server (2:1.20.8-2ubuntu2) focal; urgency=medium

  * randr-auto-bind-of-gpu-is-a-config-change.diff: Backport GPU hotplug
    RandR fix. (LP: #1862753)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 06 Apr 2020 12:39:29 +0300

xorg-server (2:1.20.8-2ubuntu1) focal; urgency=medium

  * Merge from Debian.
  * modesetting-Disable-atomic-support-by-default.patch: Dropped,
    upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Sun, 05 Apr 2020 07:19:23 +0300

xorg-server (2:1.20.8-2) unstable; urgency=medium

  * rules: Exclude udeb/ from indep dh_missing. (Closes: #955399)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 31 Mar 2020 13:14:40 +0300

xorg-server (2:1.20.8-1) unstable; urgency=medium

  * New upstream release.
  * patches: Dropped patches applied upstream:
    - fix-modesetting-build.diff
    - add-EGL_QUERY_DRIVER-check.diff
    - fix-rotate-crash.diff
  * control: Use debhelper-compat, bump to 12.
  * rules: Migrate to dh_missing.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 30 Mar 2020 15:48:38 +0300

xorg-server (2:1.20.7-4) unstable; urgency=medium

  [ Jordan Justen ]
  * add-EGL_QUERY_DRIVER-check.diff: Add missing change from upstream
    to fix glamor getting the driver name from EGL.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 29 Feb 2020 07:05:06 +0200

xorg-server (2:1.20.7-3) unstable; urgency=medium

  * fix-rotate-crash.diff: Fix a crash if rotation is set on xorg.conf.
    (Closes: #949257)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 05 Feb 2020 18:27:36 +0200

xorg-server (2:1.20.7-2ubuntu2) focal; urgency=medium

  * No-change rebuild with fixed binutils on arm64.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 08 Feb 2020 11:21:37 +0000

xorg-server (2:1.20.7-2ubuntu1) focal; urgency=medium

  * Merge from debian.
  * use-EGL_MESA_query_driver.diff: Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2020 15:43:13 +0200

xorg-server (2:1.20.7-2) unstable; urgency=medium

  * add-EGL_QUERY_DRIVER-check.diff: Add a check for EGL_QUERY_DRIVER to
    autotools.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2020 12:13:49 +0200

xorg-server (2:1.20.7-1) unstable; urgency=medium

  * New upstream release.
  * 07_use-modesetting-driver-by-default-on-GeForce.diff: Modified to
    not include xf86drm.h on Hurd. (Closes: #947746)
  * control: Add mesa-common-dev and libx11-xcb-dev to build-depends.
    (Closes: #947748)
  * serverminver: Bump video abi minor.
  * fix-modesetting-build.diff: Add a missing include to fix the build.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2020 10:50:19 +0200

xorg-server (2:1.20.6-1ubuntu2) UNRELEASED; urgency=medium

  * use-EGL_MESA_query_driver.diff: Bypass pci-id's when selecting the
    DRI2 driver, allows loading 'iris' on Tiger Lake. Bump libepoxy
    build-dep to 1.5.4, and bump d/serverminver.
  * rules: Skip building xdmx-tools on i386.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 04 Dec 2019 19:24:25 +0200

xorg-server (2:1.20.6-1ubuntu1) focal; urgency=medium

  * Merge from Debian.
  * compiler.h-Do-not-include-sys-io.h-on-ARM-with-glibc.patch:
    Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 26 Nov 2019 11:25:06 +0200

xorg-server (2:1.20.6-1) unstable; urgency=medium

  [ Sven Joachim ]
  * Remove the explicit build and build-indep targets (Closes: #941128).
  * Exclude the directory where xorg-server.tar.xz is built from it
    (Closes: #930405).
  * Make the xorg-server-source binary package reproducible by specifying
    suitable options to tar when creating /tmp/xorg-server.tar.xz.
  * Set Rules-Requires-Root to binary-targets.
  * Drop dependency on dummy package libegl1-mesa (Closes: #930608).
  * Remove no longer used lintian overrides from version 2:1.11.2.901-1.
  * Bump debhelper compat level to 11.
    - Drop autoreconf and --parallel from the dh sequence, default since
      compat level 10.  Remove dh-autoreconf from Build-Depends, redundant.
  * Drop dpkg-dev build dependency, already fulfilled in wheezy.
  * Add xz-utils to Build-Depends-Indep.
  * Fix a typo in the xvfb-run manpage.

  [ Timo Aaltonen ]
  * New upstream release.
  * Add signing key from Matt Turner.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 25 Nov 2019 11:49:09 +0200

xorg-server (2:1.20.5+git20191008-0ubuntu1) eoan; urgency=medium

  * Sync with current server-1.20-branch.
    - includes Xwayland, abi fixes
    - fix-abi-for-1.20.diff: Dropped, upstream
  * rules: Fix ftbfs, remove the explicit build and build-indep targets.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 08 Oct 2019 12:43:30 +0300

xorg-server (2:1.20.5+git20190820-0ubuntu4) eoan; urgency=medium

  * dri2-set-fallback-names-amd-intel.diff: Use a fallback driver for
    AMD and Intel. (LP: #1845149)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 24 Sep 2019 12:31:21 +0300

xorg-server (2:1.20.5+git20190820-0ubuntu3) eoan; urgency=medium

  * modesetting-Disable-atomic-support-by-default.patch: Disable atomic
    modesetting support by default.
  * compiler.h-Do-not-include-sys-io.h-on-ARM-with-glibc.patch: Fix
    build on armhf.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 05 Sep 2019 17:23:31 +0300

xorg-server (2:1.20.5+git20190820-0ubuntu2) eoan; urgency=medium

  * No-change upload with strops.h and sys/strops.h removed in glibc.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 05 Sep 2019 11:17:11 +0000

xorg-server (2:1.20.5+git20190820-0ubuntu1) eoan; urgency=medium

  * Sync with upstream server-1.20-branch to gain support for GLX vendor
    selection. (LP: #1839555)
  * sync-i965-pciids.diff, dix-ensure-work-queues-are-cleared-on-reset.diff:
    Dropped, upstream.
  * fix-abi-for-1.20.diff: Fix ABI after merging GLX vendor selection.
  * dri2-use-va-gl-for-intel.diff: Use va_gl as VDPAU driver for Intel
    GPUs.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 20 Aug 2019 10:57:08 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog xserver-common`.
