xorg-server (2:21.1.22-1ubuntu4) stonking; urgency=medium

  * Fix two SIGSEGV crashes on runtime GPU-screen (DisplayLink/evdi)
    hotplug of modesetting platform-GPU screens (LP: #2160643): DGA
    defaults on hotplug-added GPU screens (cherry-pick dbcd36b, MR
    !2244) and NULL-guard the udev fallback bus-id subsystem lookup
    (cherry-pick 9babe7e7, MR !2245).

 -- Gary T. Giesen <ggiesen@giesen.me>  Tue, 14 Jul 2026 15:13:45 -0400

xorg-server (2:21.1.22-1ubuntu3) stonking; urgency=medium

  * Update boot_display patch for another case that had a problem.
    (LP: #2136140)

 -- Mario Limonciello <superm1@debian.org>  Mon, 29 Jun 2026 10:40:12 -0500

xorg-server (2:21.1.22-1ubuntu2) stonking; urgency=medium

  * Backport a patch from upstream to use boot_display.
    (LP: #2136140)

 -- Mario Limonciello <superm1@debian.org>  Fri, 12 Jun 2026 07:28:45 -0500

xorg-server (2:21.1.22-1ubuntu1) resolute; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 15 Apr 2026 12:50:31 +0300

xorg-server (2:21.1.22-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
    - CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
    - CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
    - CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
    - CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Apr 2026 16:59:22 +0300

xorg-server (2:21.1.21-1ubuntu1) resolute; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 08 Dec 2025 15:59:26 +0200

xorg-server (2:21.1.21-1) unstable; urgency=medium

  * New upstream release.
  * control: Migrate to libselinux-dev.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 25 Nov 2025 15:09:21 +0200

xorg-server (2:21.1.20-1) unstable; urgency=medium

  * New upstream release. (Closes: #1119267)
  * CVE-2025-62229: Use-after-free in XPresentNotify structures creation
  * CVE-2025-62230: Use-after-free in Xkb client resource removal
  * CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Wed, 29 Oct 2025 11:09:04 +0100

xorg-server (2:21.1.18-2) unstable; urgency=medium

  [ NoisyCoil ]
  * Drop apple silicon patch, merged upstream

  [ Timo Aaltonen ]
  * Upload to unstable.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 27 Aug 2025 14:13:25 +0300

xorg-server (2:21.1.18-1ubuntu1) questing; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 27 Jun 2025 11:02:58 +0300

xorg-server (2:21.1.18-1) experimental; urgency=medium

  * New upstream release.
  * patches: Drop upstreamed CVE fixes.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 27 Jun 2025 10:50:42 +0300

xorg-server (2:21.1.16-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * os: Check for integer overflow on BigRequest length (CVE-2025-49176)
    (Closes: #1108073)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 20 Jun 2025 09:47:20 +0200

xorg-server (2:21.1.16-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * render: Avoid 0 or less animated cursors (CVE-2025-49175)
  * os: Do not overflow the integer size with BigRequest (CVE-2025-49176)
  * xfixes: Check request length for SetClientDisconnectMode (CVE-2025-49177)
  * os: Account for bytes to ignore when sharing input buffer (CVE-2025-49178)
  * record: Check for overflow in RecordSanityCheckRegisterClients()
    (CVE-2025-49179)
  * randr: Check for overflow in RRChangeProviderProperty() (CVE-2025-49180)
  * xfree86: Check for RandR provider functions (CVE-2025-49180)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 12 Jun 2025 21:03:24 +0200

xorg-server (2:21.1.16-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * dix: Hold input lock for AttachDevice() (CVE-2022-49737)
    (Closes: #1081338)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 02 May 2025 15:04:19 +0200

xorg-server (2:21.1.16-1ubuntu1) plucky; urgency=medium

  * Merge from Debian.
  * lp1861609-dri2-Protect-against-dri2ClientPrivate-assertio.patch:
    Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 26 Feb 2025 15:02:02 +0200

xorg-server (2:21.1.16-1) unstable; urgency=medium

  * New upstream release. Fixes:
    - CVE-2025-26594: use-after-free of the root cursor
    - CVE-2025-26595: buffer overflow in XkbVModMaskText
    - CVE-2025-26596: heap overflow in XkbWriteKeySyms
    - CVE-2025-26597: buffer overflow in XkbChangeTypesOfKey
    - CVE-2025-26598: out-of-bounds write in CreatePointerBarrierClient
    - CVE-2025-26599: use of uninitialized pointer in compRedirectWindow
    - CVE-2025-26600: use-after-free in PlayReleasedEvents
    - CVE-2025-26601: use-after-free in SyncInitTrigger
    (Closes: #1098906).
  * debian/patches/03_autotools-enable-static-use-of-Nettle-for-SHA1.diff,
    debian/patches/xfree86-fbdevhw-fix-pci-detection-on-recent-Linux.patch:
    - Dropped, included upstream.

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Wed, 26 Feb 2025 10:22:45 +0100

xorg-server (2:21.1.15-3) unstable; urgency=medium

  [ Daniel Kahn Gillmor ]
  * Fix fuzz in apple silicon patch
  * Use statically linked nettle from upstream
  * Use nettle for sha1 (Closes: #1095785)

  [ Emilio Pozuelo Monfort ]
  * Release to sid.

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Thu, 13 Feb 2025 09:37:51 +0100

xorg-server (2:21.1.15-2ubuntu2) plucky; urgency=medium

  [ Matthew Ruffell ]
  * If a client application has not called DRI2ScreenInit(),
    DRI2Authenticate() and DRI2CreateDrawable2() cause the X server to
    crash. This patch adds some sanity checks to ensure the X server
    stays running. (LP: #1861609)
    - d/p/lp1861609-dri2-Protect-against-dri2ClientPrivate-assertio.patch

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 16 Jan 2025 14:41:41 +0200

xorg-server (2:21.1.15-2ubuntu1) plucky; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 20 Dec 2024 09:11:51 +0200

xorg-server (2:21.1.15-2) unstable; urgency=medium

  * New upstream release.
  * patches: Fix pci detection on recent linux. (Closes: #1075713)

  [ Simo McVittie ]
  * xvfb-run: Special-case "-e /dev/stderr", etc. as redirection
    (Closes: #1087418, #921657)

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 20 Dec 2024 08:54:21 +0200

xorg-server (2:21.1.14-2ubuntu1) plucky; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 12 Nov 2024 15:59:27 +0200

xorg-server (2:21.1.14-2) unstable; urgency=medium

  [ Simon McVittie ]
  * Disable libunwind on armhf (closes: #1084230, #1085704)
  * Check basic functionality of xvfb-run at build-time
  * Add an autopkgtest to verify basic functionality of xvfb-run

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 12 Nov 2024 15:56:38 +0200

xorg-server (2:21.1.14-1ubuntu1) plucky; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 04 Nov 2024 11:56:10 +0200

xorg-server (2:21.1.14-1) unstable; urgency=high

  * New upstream release
    + CVE-2024-9632: Heap-based buffer overflow privilege escalation in
      _XkbSetCompatMap (closes: #1086244)

 -- Julien Cristau <jcristau@debian.org>  Tue, 29 Oct 2024 17:25:14 +0100

xorg-server (2:21.1.13-3) unstable; urgency=medium

  [ Tobias Heider ]
  * Backport config quirk for apple silicon (closes: #1080099)

  [ Emilio Pozuelo Monfort ]
  * Build-dep on libxcb-util-dev instead of libxcb-util0-dev.

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Wed, 23 Oct 2024 12:48:58 +0200

xorg-server (2:21.1.13-2ubuntu1) oracular; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 29 Aug 2024 16:21:51 +0300

xorg-server (2:21.1.13-2) unstable; urgency=medium

  * patches: Fix i386 build with gcc-14.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 29 Aug 2024 15:54:05 +0300

xorg-server (2:21.1.13-1) unstable; urgency=medium

  * New upstream release.
  * Update signing-key.asc.
  * Add upstream metadata, drop old git url from d/watch.
  * control: Migrate to pkgconf.
  * control: Substitute libgl1-mesa-dev build-dep to libglvnd-dev.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 29 Aug 2024 15:18:01 +0300

xorg-server (2:21.1.12-1ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 12 Apr 2024 12:10:06 +0300

xorg-server (2:21.1.12-1) unstable; urgency=medium

  * New upstream release.
  * render: Avoid possible double-free in ProcRenderAddGlyphs()
    (closes: #1068470)

 -- Julien Cristau <jcristau@debian.org>  Wed, 10 Apr 2024 10:44:55 +0200

xorg-server (2:21.1.11-3) unstable; urgency=high

  [ Chris Hofstaedtler ]
  * Use udev.pc to place udev files (Closes: #1057945)

  [ Julien Cristau ]
  * Pull from upstream server-21.1-branch:
    - hw/xfree86: fix NULL pointer refrence to mode name
    - Initialize Mode->name in xf86CVTMode()
    - Allow disabling byte-swapped clients
    - Xext: SProcSyncCreateFence needs to swap drawable id too
    - Xi: ProcXIGetSelectedEvents needs to use unswapped length to send
      reply (CVE-2024-31080)
    - Xi: ProcXIPassiveGrabDevice needs to use unswapped length to send
      reply (CVE-2024-31081)
    - Xquartz: ProcAppleDRICreatePixmap needs to use unswapped length to
      send reply (CVE-2024-31082)
    - render: fix refcounting of glyphs during ProcRenderAddGlyphs
      (CVE-2024-31083)
  * dix-Fix-use-after-free-in-input-device-shutdown.patch: drop (now upstream).

 -- Julien Cristau <jcristau@debian.org>  Wed, 03 Apr 2024 21:09:12 +0200

xorg-server (2:21.1.11-2ubuntu2) noble; urgency=medium

  * d/p/fix-suspend-resume-with-no-input-device.patch (LP: #2056331)
    - Make sure info->active and info->vt_active are false
      after dropping drm master.
    - Normally, this is done when pausing the first
      input device, so it breaks when there are no
      input device at all.

 -- Talha Can Havadar <talha.can.havadar@canonical.com>  Wed, 07 Mar 2024 16:29:06 +0900

xorg-server (2:21.1.11-2ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 23 Jan 2024 16:01:48 +0200

xorg-server (2:21.1.11-2) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * dix: Fix use after free in input device shutdown (Closes: #1061110)

 -- Julien Cristau <jcristau@debian.org>  Mon, 22 Jan 2024 13:17:07 +0100

xorg-server (2:21.1.11-1ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 18 Jan 2024 17:38:50 +0200

xorg-server (2:21.1.11-1) unstable; urgency=medium

  * New upstream release, fixes:
    - CVE-2023-6816
    - CVE-2024-0229
    - CVE-2024-21885
    - CVE-2024-21886
    - CVE-2024-0408
    - CVE-2024-0409

 -- Julien Cristau <jcristau@debian.org>  Tue, 16 Jan 2024 15:33:53 +0100

xorg-server (2:21.1.10-1ubuntu1) noble; urgency=medium

  * Merge from Debian.
    - Drop upstreamed patches

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 10:18:49 +0200

xorg-server (2:21.1.10-1) unstable; urgency=medium

  [ Emilio Pozuelo Monfort ]
  * Fix build on hurd-amd64. Thanks Samuel Thibault. (Closes: #1055412)

  [ Timo Aaltonen ]
  * New upstream release.
    - CVE-2023-6377
    - CVE-2023-6478

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 09:51:20 +0200

xorg-server (2:21.1.9-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-5367
    - CVE-2023-5380
    - CVE-2023-5574

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Oct 2023 10:43:00 +0300

xorg-server (2:21.1.8-1) unstable; urgency=medium

  * patches: Drop an obsolete patch. (Closes: #1034413)
  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 01 Aug 2023 12:26:02 +0300

xorg-server (2:21.1.7-3ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
    RRChangeOutputProperty
    - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
      and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
    - CVE-2023-5367
  * SECURITY UPDATE: Use-after-free bug in DestroyWindow
    - debian/patches/CVE-2023-5380.patch: reset the PointerWindows
      reference on screen switch in dix/enterleave.h, include/eventstr.h,
      mi/mipointer.c.
    - CVE-2023-5380

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 23 Oct 2023 12:20:07 -0400

xorg-server (2:21.1.7-3ubuntu2) mantic; urgency=medium

  * Remove reverse-applicable CVE-2023-1393.patch.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 26 Jul 2023 13:20:42 -0500

xorg-server (2:21.1.7-3ubuntu1) mantic; urgency=medium

  * Merge from Debian.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 26 Jul 2023 13:06:51 -0500

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog xserver-common`.
