xorg-server (2:21.1.18-1ubuntu1.1) questing-security; urgency=medium

  * SECURITY UPDATE: Use-after-free in XPresentNotify structures creation
    - debian/patches/CVE-2025-62229.patch: fix use-after-free in
      present/present_notify.c.
    - CVE-2025-62229
  * SECURITY UPDATE: Use-after-free in Xkb client resource removal
    - debian/patches/CVE-2025-62230-1.patch: make the RT_XKBCLIENT resource
      private in xkb/xkb.c, include/xkbsrv.h.
    - debian/patches/CVE-2025-62230-2.patch: free the XKB resource when
      freeing XkbInterest in xkb/xkbEvents.c.
    - CVE-2025-62230
  * SECURITY UPDATE: Value overflow in Xkb extension XkbSetCompatMap()
    - debian/patches/CVE-2025-62231.patch: prevent overflow in xkb/xkb.c.
    - CVE-2025-62231

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Oct 2025 13:18:34 -0400

xorg-server (2:21.1.18-1ubuntu1) questing; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 27 Jun 2025 11:02:58 +0300

xorg-server (2:21.1.18-1) experimental; urgency=medium

  * New upstream release.
  * patches: Drop upstreamed CVE fixes.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 27 Jun 2025 10:50:42 +0300

xorg-server (2:21.1.16-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * os: Check for integer overflow on BigRequest length (CVE-2025-49176)
    (Closes: #1108073)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 20 Jun 2025 09:47:20 +0200

xorg-server (2:21.1.16-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * render: Avoid 0 or less animated cursors (CVE-2025-49175)
  * os: Do not overflow the integer size with BigRequest (CVE-2025-49176)
  * xfixes: Check request length for SetClientDisconnectMode (CVE-2025-49177)
  * os: Account for bytes to ignore when sharing input buffer (CVE-2025-49178)
  * record: Check for overflow in RecordSanityCheckRegisterClients()
    (CVE-2025-49179)
  * randr: Check for overflow in RRChangeProviderProperty() (CVE-2025-49180)
  * xfree86: Check for RandR provider functions (CVE-2025-49180)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 12 Jun 2025 21:03:24 +0200

xorg-server (2:21.1.16-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * dix: Hold input lock for AttachDevice() (CVE-2022-49737)
    (Closes: #1081338)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 02 May 2025 15:04:19 +0200

xorg-server (2:21.1.16-1ubuntu1) plucky; urgency=medium

  * Merge from Debian.
  * lp1861609-dri2-Protect-against-dri2ClientPrivate-assertio.patch:
    Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 26 Feb 2025 15:02:02 +0200

xorg-server (2:21.1.16-1) unstable; urgency=medium

  * New upstream release. Fixes:
    - CVE-2025-26594: use-after-free of the root cursor
    - CVE-2025-26595: buffer overflow in XkbVModMaskText
    - CVE-2025-26596: heap overflow in XkbWriteKeySyms
    - CVE-2025-26597: buffer overflow in XkbChangeTypesOfKey
    - CVE-2025-26598: out-of-bounds write in CreatePointerBarrierClient
    - CVE-2025-26599: use of uninitialized pointer in compRedirectWindow
    - CVE-2025-26600: use-after-free in PlayReleasedEvents
    - CVE-2025-26601: use-after-free in SyncInitTrigger
    (Closes: #1098906).
  * debian/patches/03_autotools-enable-static-use-of-Nettle-for-SHA1.diff,
    debian/patches/xfree86-fbdevhw-fix-pci-detection-on-recent-Linux.patch:
    - Dropped, included upstream.

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Wed, 26 Feb 2025 10:22:45 +0100

xorg-server (2:21.1.15-3) unstable; urgency=medium

  [ Daniel Kahn Gillmor ]
  * Fix fuzz in apple silicon patch
  * Use statically linked nettle from upstream
  * Use nettle for sha1 (Closes: #1095785)

  [ Emilio Pozuelo Monfort ]
  * Release to sid.

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Thu, 13 Feb 2025 09:37:51 +0100

xorg-server (2:21.1.15-2ubuntu2) plucky; urgency=medium

  [ Matthew Ruffell ]
  * If a client application has not called DRI2ScreenInit(),
    DRI2Authenticate() and DRI2CreateDrawable2() cause the X server to
    crash. This patch adds some sanity checks to ensure the X server
    stays running. (LP: #1861609)
    - d/p/lp1861609-dri2-Protect-against-dri2ClientPrivate-assertio.patch

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 16 Jan 2025 14:41:41 +0200

xorg-server (2:21.1.15-2ubuntu1) plucky; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 20 Dec 2024 09:11:51 +0200

xorg-server (2:21.1.15-2) unstable; urgency=medium

  * New upstream release.
  * patches: Fix pci detection on recent linux. (Closes: #1075713)

  [ Simo McVittie ]
  * xvfb-run: Special-case "-e /dev/stderr", etc. as redirection
    (Closes: #1087418, #921657)

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 20 Dec 2024 08:54:21 +0200

xorg-server (2:21.1.14-2ubuntu1) plucky; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 12 Nov 2024 15:59:27 +0200

xorg-server (2:21.1.14-2) unstable; urgency=medium

  [ Simon McVittie ]
  * Disable libunwind on armhf (closes: #1084230, #1085704)
  * Check basic functionality of xvfb-run at build-time
  * Add an autopkgtest to verify basic functionality of xvfb-run

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 12 Nov 2024 15:56:38 +0200

xorg-server (2:21.1.14-1ubuntu1) plucky; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 04 Nov 2024 11:56:10 +0200

xorg-server (2:21.1.14-1) unstable; urgency=high

  * New upstream release
    + CVE-2024-9632: Heap-based buffer overflow privilege escalation in
      _XkbSetCompatMap (closes: #1086244)

 -- Julien Cristau <jcristau@debian.org>  Tue, 29 Oct 2024 17:25:14 +0100

xorg-server (2:21.1.13-3) unstable; urgency=medium

  [ Tobias Heider ]
  * Backport config quirk for apple silicon (closes: #1080099)

  [ Emilio Pozuelo Monfort ]
  * Build-dep on libxcb-util-dev instead of libxcb-util0-dev.

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Wed, 23 Oct 2024 12:48:58 +0200

xorg-server (2:21.1.13-2ubuntu1) oracular; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 29 Aug 2024 16:21:51 +0300

xorg-server (2:21.1.13-2) unstable; urgency=medium

  * patches: Fix i386 build with gcc-14.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 29 Aug 2024 15:54:05 +0300

xorg-server (2:21.1.13-1) unstable; urgency=medium

  * New upstream release.
  * Update signing-key.asc.
  * Add upstream metadata, drop old git url from d/watch.
  * control: Migrate to pkgconf.
  * control: Substitute libgl1-mesa-dev build-dep to libglvnd-dev.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 29 Aug 2024 15:18:01 +0300

xorg-server (2:21.1.12-1ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 12 Apr 2024 12:10:06 +0300

xorg-server (2:21.1.12-1) unstable; urgency=medium

  * New upstream release.
  * render: Avoid possible double-free in ProcRenderAddGlyphs()
    (closes: #1068470)

 -- Julien Cristau <jcristau@debian.org>  Wed, 10 Apr 2024 10:44:55 +0200

xorg-server (2:21.1.11-3) unstable; urgency=high

  [ Chris Hofstaedtler ]
  * Use udev.pc to place udev files (Closes: #1057945)

  [ Julien Cristau ]
  * Pull from upstream server-21.1-branch:
    - hw/xfree86: fix NULL pointer refrence to mode name
    - Initialize Mode->name in xf86CVTMode()
    - Allow disabling byte-swapped clients
    - Xext: SProcSyncCreateFence needs to swap drawable id too
    - Xi: ProcXIGetSelectedEvents needs to use unswapped length to send
      reply (CVE-2024-31080)
    - Xi: ProcXIPassiveGrabDevice needs to use unswapped length to send
      reply (CVE-2024-31081)
    - Xquartz: ProcAppleDRICreatePixmap needs to use unswapped length to
      send reply (CVE-2024-31082)
    - render: fix refcounting of glyphs during ProcRenderAddGlyphs
      (CVE-2024-31083)
  * dix-Fix-use-after-free-in-input-device-shutdown.patch: drop (now upstream).

 -- Julien Cristau <jcristau@debian.org>  Wed, 03 Apr 2024 21:09:12 +0200

xorg-server (2:21.1.11-2ubuntu2) noble; urgency=medium

  * d/p/fix-suspend-resume-with-no-input-device.patch (LP: #2056331)
    - Make sure info->active and info->vt_active are false
      after dropping drm master.
    - Normally, this is done when pausing the first
      input device, so it breaks when there are no
      input device at all.

 -- Talha Can Havadar <talha.can.havadar@canonical.com>  Wed, 07 Mar 2024 16:29:06 +0900

xorg-server (2:21.1.11-2ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 23 Jan 2024 16:01:48 +0200

xorg-server (2:21.1.11-2) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * dix: Fix use after free in input device shutdown (Closes: #1061110)

 -- Julien Cristau <jcristau@debian.org>  Mon, 22 Jan 2024 13:17:07 +0100

xorg-server (2:21.1.11-1ubuntu1) noble; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 18 Jan 2024 17:38:50 +0200

xorg-server (2:21.1.11-1) unstable; urgency=medium

  * New upstream release, fixes:
    - CVE-2023-6816
    - CVE-2024-0229
    - CVE-2024-21885
    - CVE-2024-21886
    - CVE-2024-0408
    - CVE-2024-0409

 -- Julien Cristau <jcristau@debian.org>  Tue, 16 Jan 2024 15:33:53 +0100

xorg-server (2:21.1.10-1ubuntu1) noble; urgency=medium

  * Merge from Debian.
    - Drop upstreamed patches

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 10:18:49 +0200

xorg-server (2:21.1.10-1) unstable; urgency=medium

  [ Emilio Pozuelo Monfort ]
  * Fix build on hurd-amd64. Thanks Samuel Thibault. (Closes: #1055412)

  [ Timo Aaltonen ]
  * New upstream release.
    - CVE-2023-6377
    - CVE-2023-6478

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Dec 2023 09:51:20 +0200

xorg-server (2:21.1.9-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2023-5367
    - CVE-2023-5380
    - CVE-2023-5574

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Oct 2023 10:43:00 +0300

xorg-server (2:21.1.8-1) unstable; urgency=medium

  * patches: Drop an obsolete patch. (Closes: #1034413)
  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 01 Aug 2023 12:26:02 +0300

xorg-server (2:21.1.7-3ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: OOB write in XIChangeDeviceProperty and
    RRChangeOutputProperty
    - debian/patches/CVE-2023-5367.patch: fix handling of PropModeAppend
      and PropModePrepend in Xi/xiproperty.c, randr/rrproperty.c.
    - CVE-2023-5367
  * SECURITY UPDATE: Use-after-free bug in DestroyWindow
    - debian/patches/CVE-2023-5380.patch: reset the PointerWindows
      reference on screen switch in dix/enterleave.h, include/eventstr.h,
      mi/mipointer.c.
    - CVE-2023-5380

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 23 Oct 2023 12:20:07 -0400

xorg-server (2:21.1.7-3ubuntu2) mantic; urgency=medium

  * Remove reverse-applicable CVE-2023-1393.patch.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 26 Jul 2023 13:20:42 -0500

xorg-server (2:21.1.7-3ubuntu1) mantic; urgency=medium

  * Merge from Debian.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 26 Jul 2023 13:06:51 -0500

xorg-server (2:21.1.7-3) unstable; urgency=medium

  * Enable DRI2 for the udeb build, needed in addition to DRM support
    since 9c81b8f5b5 to build the modesetting driver. This fixes failures
    to start X in the graphical installer under UTM (Closes: #1035014).
    Thanks to Keith Toh for the report and the follow-up tests!

 -- Cyril Brulebois <kibi@debian.org>  Wed, 03 May 2023 03:41:41 +0200

xorg-server (2:21.1.7-2) unstable; urgency=high

  * composite: Fix use-after-free of the COW
    ZDI-CAN-19866/CVE-2023-1393

 -- Julien Cristau <jcristau@debian.org>  Wed, 29 Mar 2023 15:11:07 +0200

xorg-server (2:21.1.7-1ubuntu3) lunar; urgency=medium

  * SECURITY UPDATE: Overlay Window Use-After-Free
    - debian/patches/CVE-2023-1393.patch: fix use-after-free of the COW in
      composite/compwindow.c.
    - CVE-2023-1393

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 31 Mar 2023 12:53:56 -0400

xorg-server (2:21.1.7-1ubuntu2) lunar; urgency=medium

  * patches: Force update LEDs after device state update. (LP: #1993621)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 21 Feb 2023 17:08:20 +0200

xorg-server (2:21.1.7-1ubuntu1) lunar; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 08 Feb 2023 15:51:43 +0200

xorg-server (2:21.1.7-1) unstable; urgency=medium

  * New upstream release
    + Xi: fix potential use-after-free in DeepCopyPointerClasses
      (CVE-2023-0494, closes: #1030777)

 -- Julien Cristau <jcristau@debian.org>  Tue, 07 Feb 2023 14:15:45 +0100

xorg-server (2:21.1.6-1ubuntu1) lunar; urgency=medium

  * Merge from Debian.
  * re-calculate-the-clock-and-refresh-rate.diff: Replace with a newer
    version.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 05 Jan 2023 16:11:27 +0200

xorg-server (2:21.1.6-1) unstable; urgency=medium

  * New upstream release.
  * patches: Drop upstreamed patches.
  * Add signing-key from Olivier Fourdan.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 05 Jan 2023 16:02:46 +0200

xorg-server (2:21.1.5-1ubuntu1) lunar; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Dec 2022 11:17:57 +0200

xorg-server (2:21.1.5-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-46340, CVE-2022-46341, CVE-2022-46342, CVE-2022-46343,
      CVE-2022-46344, CVE-2022-46283
  * Add signing-key from Peter Hutterer.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Dec 2022 11:10:24 +0200

xorg-server (2:21.1.4-3ubuntu2) lunar; urgency=medium

  * re-calculate-the-clock-and-refresh-rate.diff: Import v2, fix a
    crash. (LP: #1999008)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 07 Dec 2022 11:21:17 +0200

xorg-server (2:21.1.4-3ubuntu1) lunar; urgency=medium

  * Merge from Debian.
  * re-calculate-the-clock-and-refresh-rate.diff: Fix modes on 2.5k@90Hz
    panels. (LP: #1996490)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 14 Nov 2022 09:53:38 +0200

xorg-server (2:21.1.4-3) unstable; urgency=medium

  * xkb: proof GetCountedString against request length attacks (CVE-2022-3550)
  * xkb: fix some possible memleaks in XkbGetKbdByName (CVE-2022-3551)

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Fri, 11 Nov 2022 13:35:13 +0100

xorg-server (2:21.1.4-2ubuntu1) kinetic; urgency=medium

  * Merge from Debian.
  * Drop CVE patches, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 14 Sep 2022 12:59:30 +0300

xorg-server (2:21.1.4-2) unstable; urgency=medium

  * 001_fedora_extramodes.patch: Dropped, apparently obsolete since
    1.5.0. (LP: #1990456)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 22 Sep 2022 08:53:59 +0300

xorg-server (2:21.1.4-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2022-2319, CVE-2022-2320 (Closes: #1014903)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 25 Jul 2022 12:46:43 +0300

xorg-server (2:21.1.3-2ubuntu3) kinetic; urgency=medium

  * SECURITY UPDATE: ProcXkbSetGeometry Out-Of-Bounds Access
    - debian/patches/CVE-2022-2319-pre1.patch: switch to array index loops
      to moving pointers in xkb/xkb.c.
    - debian/patches/CVE-2022-2319.patch: add request length validation for
      XkbSetGeometry in xkb/xkb.c.
    - CVE-2022-2319
  * SECURITY UPDATE: ProcXkbSetDeviceInfo Out-Of-Bounds Access
    - debian/patches/CVE-2022-2320.patch: swap XkbSetDeviceInfo and
      XkbSetDeviceInfoCheck in xkb/xkb.c.
    - CVE-2022-2320

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 06 Jul 2022 09:45:33 -0400

xorg-server (2:21.1.3-2ubuntu2) jammy; urgency=medium

  * rules: Drop special case for i386, dmx is gone.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 01 Mar 2022 16:33:35 +0200

xorg-server (2:21.1.3-2ubuntu1) jammy; urgency=medium

  * Merge from Debian.
  * patches: Drop upstreamed patches.
  * patches: Refreshed.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 23 Feb 2022 17:20:53 +0200

xorg-server (2:21.1.3-2) unstable; urgency=medium

  * present-Check-for-NULL-to-prevent-crash.patch: Fix a crash with
    nvidia 495.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 09 Feb 2022 12:19:09 +0200

xorg-server (2:21.1.3-1) experimental; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 10 Jan 2022 17:54:12 +0200

xorg-server (2:21.1.1-2) experimental; urgency=medium

  * Fix serverminver.
  * control: Add libxcvt-dev to xserver-xorg-dev depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 27 Nov 2021 11:18:56 +0200

xorg-server (2:21.1.1-1) experimental; urgency=medium

  * New upstream release.
  * 04_compiler_h_inb_outb_mips.diff: Dropped, upstream.
  * Xwayland is dropped from this souce, don't try to build it.
  * Xdmx is gone, drop it from the build.
  * serverminver: Bump versions.
  * control: Bump x11proto-dev and libx1-dev depends.
  * control: Add libxcvt-dev to build-depends, xcvt to -core Recommends.
  * control: Bump libdrm-dev build-depends.
  * Update signing-key.asc.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Nov 2021 16:31:46 +0200

xorg-server (2:1.20.14-1ubuntu1) jammy; urgency=medium

  * Merge from Debian.
  * CVE patches dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 11 Jan 2022 16:51:48 +0200

xorg-server (2:1.20.14-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 11 Jan 2022 16:21:08 +0200

xorg-server (2:1.20.13-3) unstable; urgency=high

  * Team upload.
  * record: Fix out of bounds access in SwapCreateRegister() [CVE-2021-4011]
  * xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() [CVE-2021-4009]
  * Xext: Fix out of bounds access in SProcScreenSaverSuspend() [CVE-2021-4010]
  * render: Fix out of bounds access in SProcRenderCompositeGlyphs() [CVE-2021-4008]

 -- Julien Cristau <jcristau@debian.org>  Tue, 14 Dec 2021 14:38:21 +0100

xorg-server (2:1.20.13-2) unstable; urgency=medium

  * Upload to unstable.
  * Disable building xwayland.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 27 Nov 2021 13:03:35 +0200

xorg-server (2:1.20.13-1ubuntu2) jammy; urgency=medium

  * SECURITY UPDATE: SProcRenderCompositeGlyphs out-of-bounds access
    - debian/patches/CVE-2021-4008.patch: check lengths in render/render.c.
    - CVE-2021-4008
  * SECURITY UPDATE: SProcXFixesCreatePointerBarrier out-of-bounds access
    - debian/patches/CVE-2021-4009.patch: use sizes in xfixes/cursor.c.
    - CVE-2021-4009
  * SECURITY UPDATE: SProcScreenSaverSuspend out-of-bounds access
    - debian/patches/CVE-2021-4010.patch: fix logic in Xext/saver.c.
    - CVE-2021-4010
  * SECURITY UPDATE: SwapCreateRegister out-of-bounds access
    - debian/patches/CVE-2021-4011.patch: fix length in record/record.c.
    - CVE-2021-4011

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 14 Dec 2021 11:11:36 -0500

xorg-server (2:1.20.13-1ubuntu1) impish; urgency=medium

  * Merge from Debian.
  * modesetting-disable-reverse-prime-offload-udl.diff: Dropped,
    upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 Aug 2021 12:32:48 +0300

xorg-server (2:1.20.13-1) experimental; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 Aug 2021 12:27:00 +0300

xorg-server (2:1.20.11-1ubuntu2) impish; urgency=medium

  * modesetting-disable-reverse-prime-offload-udl.diff: Fix a regression
    on displaylink devices after mesa update. (LP: #1931547)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 06 Jul 2021 13:17:51 +0300

xorg-server (2:1.20.11-1ubuntu1) hirsute; urgency=medium

  * Merge from Debian.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 13 Apr 2021 19:15:17 +0300

xorg-server (2:1.20.11-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2021-3472
  * Add signing key for Matt Turner.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 13 Apr 2021 19:07:31 +0300

xorg-server (2:1.20.10-3ubuntu7) hirsute; urgency=medium

  * 300-mi-sprite-SaveUnderCursor2.patch: Drop duplicate entries.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 09 Apr 2021 13:30:53 +0300

xorg-server (2:1.20.10-3ubuntu6) hirsute; urgency=medium

  * 300-mi-sprite-SaveUnderCursor2.patch: Fix cursor bleeding issue
    (LP: #1911479).
    The new function, miDCSaveUnderCursor2, is required by Xilinx armsoc driver

 -- Ethan Hsieh <ethan.hsieh@canonical.com>  Fri, 19 Mar 2021 12:55:11 +0000

xorg-server (2:1.20.10-3ubuntu5) hirsute; urgency=medium

  * Disable building xwayland.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 26 Mar 2021 15:16:17 +0200

xorg-server (2:1.20.10-3ubuntu4) hirsute; urgency=medium

  * Disable building with lto, it's a 20+GB link not yet investigated.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 26 Mar 2021 13:37:55 +0100

xorg-server (2:1.20.10-3ubuntu3) hirsute; urgency=medium

  * Stop building the udeb on request.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 22 Feb 2021 11:54:42 +0100

xorg-server (2:1.20.10-3ubuntu1) hirsute; urgency=medium

  * Merge from Debian.
  * patches: Drop upstreamed patches.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Feb 2021 12:30:29 +0200

xorg-server (2:1.20.10-3) unstable; urgency=medium

  [ Julien Cristau ]
  * Drop workaround for mips* FTBFS added in 2:1.20.10-1, shouldn't be
    necessary anymore with the change in 2:1.20.10-2.

  [ Sven Joachim ]
  * Recommend default-logind | logind rather than libpam-systemd in
    xserver-xorg-core (Closes: #923198).
  * Use mktemp rather than tempfile in xserver-xorg-legacy.postinst
    (Closes: #979751).
  * Use dpkg-vendor to get the vendor name, drop lsb-release from
    Build-Depends.

   [ Vagrant Cascadian ]
  * Avoid embedding the running kernel version (Closes: #976898).

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Feb 2021 11:17:43 +0200

xorg-server (2:1.20.10-2) unstable; urgency=medium

  * Stop defining inb/outb on mips, to fix FTBFS in some drivers with GCC 10
    (closes: #978670).

 -- Julien Cristau <jcristau@debian.org>  Wed, 06 Jan 2021 10:33:33 +0100

xorg-server (2:1.20.10-1) unstable; urgency=medium

  [ Timo Aaltonen ]
  * New upstream release.
    - CVE-2020-14360, CVE-2020-25712 (Closes: #976216)
  * Drop patches:
    - 0001-Revert-*: Reverted upstream in this version
    - revert-hw-xfree86-avoid-cursor-use-after-free.diff: Issue fixed in this version
    - revert-disabling-xss-for-rootless-xwayland.diff: Was resolved upstream as
      being a client bug
  * control: Add libnvidia-egl-wayland-dev to build-depends, enables
    EGLStream support in xwayland.

  [ Adrian Bunk ]
  * rules: Add a workaround to fix build on mips*. (Closes: #975579)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 02 Dec 2020 12:41:35 +0200

xorg-server (2:1.20.9-2ubuntu3) hirsute; urgency=medium

  * SECURITY UPDATE: out of bounds memory accesses on too short request
    - debian/patches/CVE-2020-14360.patch: check SetMap request length
      carefully in xkb/xkb.c.
    - CVE-2020-14360
  * SECURITY UPDATE: multiple heap overflows
    - debian/patches/CVE-2020-25712.patch: add bounds checks in xkb/xkb.c.
    - CVE-2020-25712

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Dec 2020 09:16:47 -0500

xorg-server (2:1.20.9-2ubuntu2) hirsute; urgency=medium

  * fix-gtf-detection-for-edid-14.diff: Fix a regression in detecting
    modes of an EDID 1.4 monitor. (LP: #1897530)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 30 Nov 2020 13:53:47 +0200

xorg-server (2:1.20.9-2ubuntu1) groovy; urgency=medium

  * Merge from Debian.
    - xfree86-add-drm-modes-on-non-GTF-panels.patch: Dropped, upstream
    - CVE patches dropped, upstream
  * modesetting-do-not-stop-on-entervt.diff: Dropped in favor of two
    upstream commits that got merged. (LP: #1897530)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 07 Oct 2020 08:46:52 +0300

xorg-server (2:1.20.9-2) unstable; urgency=medium

  * fix-pci-probing-segfault.diff: Dropped and revert three commits
    instead. (Closes: #969739)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 24 Sep 2020 12:19:06 +0300

xorg-server (2:1.20.9-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2020-14347 (Closes: #968986)
  * fix-pci-probing-segfault.diff: Fix a regression in 1.20.9 when
    probing the GPU.
  * revert-hw-xfree86-avoid-cursor-use-after-free.diff: Revert a commit
    which is causing server crashes.
  * revert-disabling-xss-for-rootless-xwayland.diff: Fix a regression
    where apps crash under Xwayland.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 31 Aug 2020 18:49:48 +0300

xorg-server (2:1.20.8-2ubuntu6) groovy; urgency=medium

  * SECURITY UPDATE: Out-Of-Bounds access in XkbSetNames function
    - debian/patches/CVE-2020-14345.patch: correct bounds checking in
      xkb/xkb.c.
    - CVE-2020-14345

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 04 Sep 2020 09:32:36 -0400

xorg-server (2:1.20.8-2ubuntu5) groovy; urgency=medium

  * SECURITY UPDATE: Integer underflow in the X input extension protocol
    - debian/patches/CVE-2020-14346.patch: properly calculate length in
      Xi/xichangehierarchy.c.
    - CVE-2020-14346
  * SECURITY UPDATE: server memory leak
    - debian/patches/CVE-2020-14347.patch: initialize memory in
      dix/pixmap.c.
    - CVE-2020-14347
  * SECURITY UPDATE: Integer Underflow Privilege Escalation
    - debian/patches/CVE-2020-14361.patch: fix dataLeft calculation in
      xkb/xkbSwap.c.
    - CVE-2020-14361
  * SECURITY UPDATE: Integer Underflow Privilege Escalation
    - debian/patches/CVE-2020-14362.patch: properly calculate lengths in
      record/record.c.
    - CVE-2020-14362
  * debian/control: add libffi-dev to Build-Depends to fix FTBFS.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Sep 2020 09:55:00 -0400

xorg-server (2:1.20.8-2ubuntu4) groovy; urgency=medium

  * xfree86-add-drm-modes-on-non-GTF-panels.patch: Add GTF modes on
    continuous-frequency monitors. (LP: #1883497)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 24 Jun 2020 08:50:33 +0300

xorg-server (2:1.20.8-2ubuntu3) groovy; urgency=medium

  * modesetting-do-not-stop-on-entervt.diff: Don't crash if connectors
    go missing. (LP: #1879893)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 21 May 2020 11:22:15 +0300

xorg-server (2:1.20.8-2ubuntu2) focal; urgency=medium

  * randr-auto-bind-of-gpu-is-a-config-change.diff: Backport GPU hotplug
    RandR fix. (LP: #1862753)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 06 Apr 2020 12:39:29 +0300

xorg-server (2:1.20.8-2ubuntu1) focal; urgency=medium

  * Merge from Debian.
  * modesetting-Disable-atomic-support-by-default.patch: Dropped,
    upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Sun, 05 Apr 2020 07:19:23 +0300

xorg-server (2:1.20.8-2) unstable; urgency=medium

  * rules: Exclude udeb/ from indep dh_missing. (Closes: #955399)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 31 Mar 2020 13:14:40 +0300

xorg-server (2:1.20.8-1) unstable; urgency=medium

  * New upstream release.
  * patches: Dropped patches applied upstream:
    - fix-modesetting-build.diff
    - add-EGL_QUERY_DRIVER-check.diff
    - fix-rotate-crash.diff
  * control: Use debhelper-compat, bump to 12.
  * rules: Migrate to dh_missing.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 30 Mar 2020 15:48:38 +0300

xorg-server (2:1.20.7-4) unstable; urgency=medium

  [ Jordan Justen ]
  * add-EGL_QUERY_DRIVER-check.diff: Add missing change from upstream
    to fix glamor getting the driver name from EGL.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 29 Feb 2020 07:05:06 +0200

xorg-server (2:1.20.7-3) unstable; urgency=medium

  * fix-rotate-crash.diff: Fix a crash if rotation is set on xorg.conf.
    (Closes: #949257)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 05 Feb 2020 18:27:36 +0200

xorg-server (2:1.20.7-2ubuntu2) focal; urgency=medium

  * No-change rebuild with fixed binutils on arm64.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 08 Feb 2020 11:21:37 +0000

xorg-server (2:1.20.7-2ubuntu1) focal; urgency=medium

  * Merge from debian.
  * use-EGL_MESA_query_driver.diff: Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2020 15:43:13 +0200

xorg-server (2:1.20.7-2) unstable; urgency=medium

  * add-EGL_QUERY_DRIVER-check.diff: Add a check for EGL_QUERY_DRIVER to
    autotools.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2020 12:13:49 +0200

xorg-server (2:1.20.7-1) unstable; urgency=medium

  * New upstream release.
  * 07_use-modesetting-driver-by-default-on-GeForce.diff: Modified to
    not include xf86drm.h on Hurd. (Closes: #947746)
  * control: Add mesa-common-dev and libx11-xcb-dev to build-depends.
    (Closes: #947748)
  * serverminver: Bump video abi minor.
  * fix-modesetting-build.diff: Add a missing include to fix the build.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2020 10:50:19 +0200

xorg-server (2:1.20.6-1ubuntu2) UNRELEASED; urgency=medium

  * use-EGL_MESA_query_driver.diff: Bypass pci-id's when selecting the
    DRI2 driver, allows loading 'iris' on Tiger Lake. Bump libepoxy
    build-dep to 1.5.4, and bump d/serverminver.
  * rules: Skip building xdmx-tools on i386.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 04 Dec 2019 19:24:25 +0200

xorg-server (2:1.20.6-1ubuntu1) focal; urgency=medium

  * Merge from Debian.
  * compiler.h-Do-not-include-sys-io.h-on-ARM-with-glibc.patch:
    Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 26 Nov 2019 11:25:06 +0200

xorg-server (2:1.20.6-1) unstable; urgency=medium

  [ Sven Joachim ]
  * Remove the explicit build and build-indep targets (Closes: #941128).
  * Exclude the directory where xorg-server.tar.xz is built from it
    (Closes: #930405).
  * Make the xorg-server-source binary package reproducible by specifying
    suitable options to tar when creating /tmp/xorg-server.tar.xz.
  * Set Rules-Requires-Root to binary-targets.
  * Drop dependency on dummy package libegl1-mesa (Closes: #930608).
  * Remove no longer used lintian overrides from version 2:1.11.2.901-1.
  * Bump debhelper compat level to 11.
    - Drop autoreconf and --parallel from the dh sequence, default since
      compat level 10.  Remove dh-autoreconf from Build-Depends, redundant.
  * Drop dpkg-dev build dependency, already fulfilled in wheezy.
  * Add xz-utils to Build-Depends-Indep.
  * Fix a typo in the xvfb-run manpage.

  [ Timo Aaltonen ]
  * New upstream release.
  * Add signing key from Matt Turner.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 25 Nov 2019 11:49:09 +0200

xorg-server (2:1.20.5+git20191008-0ubuntu1) eoan; urgency=medium

  * Sync with current server-1.20-branch.
    - includes Xwayland, abi fixes
    - fix-abi-for-1.20.diff: Dropped, upstream
  * rules: Fix ftbfs, remove the explicit build and build-indep targets.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 08 Oct 2019 12:43:30 +0300

xorg-server (2:1.20.5+git20190820-0ubuntu4) eoan; urgency=medium

  * dri2-set-fallback-names-amd-intel.diff: Use a fallback driver for
    AMD and Intel. (LP: #1845149)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 24 Sep 2019 12:31:21 +0300

xorg-server (2:1.20.5+git20190820-0ubuntu3) eoan; urgency=medium

  * modesetting-Disable-atomic-support-by-default.patch: Disable atomic
    modesetting support by default.
  * compiler.h-Do-not-include-sys-io.h-on-ARM-with-glibc.patch: Fix
    build on armhf.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 05 Sep 2019 17:23:31 +0300

xorg-server (2:1.20.5+git20190820-0ubuntu2) eoan; urgency=medium

  * No-change upload with strops.h and sys/strops.h removed in glibc.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 05 Sep 2019 11:17:11 +0000

xorg-server (2:1.20.5+git20190820-0ubuntu1) eoan; urgency=medium

  * Sync with upstream server-1.20-branch to gain support for GLX vendor
    selection. (LP: #1839555)
  * sync-i965-pciids.diff, dix-ensure-work-queues-are-cleared-on-reset.diff:
    Dropped, upstream.
  * fix-abi-for-1.20.diff: Fix ABI after merging GLX vendor selection.
  * dri2-use-va-gl-for-intel.diff: Use va_gl as VDPAU driver for Intel
    GPUs.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 20 Aug 2019 10:57:08 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog xserver-xorg-core`.
