id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
24259	xwayland-24.1.15	Joe Locash	SecurityAdvisory	"New point release with security fixes.

{{{
This release contains the fixes for the issues reported in today's
security advisory:

https://lists.x.org/archives/xorg-announce/2026-November/003759.html

* CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
* CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
* CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow
* CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
* CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow
* CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass
* CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply

In addition we have a variety of fixes outlined by the shortlog below.

Acts1631 (3):
       Xv: prevent overflow in shared-memory bounds check
       XTest: validate valuator range before writing
       XRes: prevent overflow in client ID request size

Alan Coopersmith (3):
       Xi: avoid memory leak when hitting bounds check for barrier events
       Xi: fix event_id & time delta in generated barrier events
       xkb: fix typo in sizeof expression

Olivier Fourdan (5):
       XRes: prevent overflow in resource bytes swap path
       glamor: prevent overflow in Xv image size calculation
       Xv: reject negative image size in PutImage
       Xv: reject negative image size in QueryImageAttributes
       Bump version to 24.1.15

git tag: xwayland-24.1.15
}}}"	enhancement	new	elevated	98-Security	BOOK	git	normal