XLibre project security advisory --------------------------------- As Xlibre Xnest is based on Xorg, it is affected by some security issues which recently became known in Xorg: CVE-2024-9632: can be triggered by providing a modified bitmap to the X.Org server. CVE-2024-9632: Heap-based buffer overflow privilege escalation in _XkbSetCompatMap See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9632 Affected versions: * 24.1.0 * 24.2.0 24.1.x release: Repo: https://gitlab.freedesktop.org/metux/xserver.git Branch: xlibre/xnest/24.1 Tag: xnest-24.1.1 SHA: 11450b0946c1035944c5946d665f21f83356b6b9 24.2.x release: Repo: https://gitlab.freedesktop.org/metux/xserver.git Branch: xlibre/xnest/24.2 Tag: xnest-24.2.1 SHA: 9a6aec9bf62b6bdd75795a5e28648d4af07fe413 These bugfix branches also contain several other pointer and bounds related problems that haven't been rated as possibly exploitable yet, but no other unnecessary changes which don't fix actual bugs. All users are strongly advised to upgrade to the fixed mainenance releases ASAP. --mtx -- --- Enrico Weigelt, metux IT consult Free software and Linux embedded engineering [email protected] -- +49-151-27565287