Mon Oct 17 19:31:45 UTC 2022
patches/packages/xorg-server-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
  xkb: proof GetCountedString against request length attacks.
  xkb: fix some possible memleaks in XkbGetKbdByName.
  xquartz: Fix a possible crash when editing the Application menu due
  to mutating immutable arrays.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3553
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-3_slack15.0.txz:  Rebuilt.
  xkb: proof GetCountedString against request length attacks.
  xkb: fix some possible memleaks in XkbGetKbdByName.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
  (* Security fix *)

[PATCH] systemclipboard: Don't signals data source cancellation

Right now we emit "selectionChanged" when either:
 - we get an external new selection
 - our own selection gets cancelled

Semantically that's correct, if our own selection gets cancelled there's
no data in the clipboard, globally it's changed.

Pragmatically, we don't need to know about the latter event. It's not
useful information for userspace code - and worst means we process
events twice if clipboard is transferred from klipper to a client.

This fixes a major issue with klipper when a user disables middle click
paste. The compositor sends a cancel event on new clipboards, klipper
detects the clipboard is empty and populates it.

Security fixes:
  CVE-2022-43680 -- Fix heap use-after-free after overeager
                    destruction of a shared DTD in function
                    XML_ExternalEntityParserCreate in out-of-memory situations.
                    Expected impact is denial of service or potentially
                    arbitrary code execution.

Commit 8a5f3ddb2 ("set tag on our surface") introduced the use of tags
to differentiate our own surfaces, and commit a1d14aa8c ("Clear the
"xwl-window" tag on unrealize") removed the tags before the surfaces are
actually destroyed.

Xwayland would then rely on these tags on the surface to decide whether
to ignore or to process the Wayland event in various places.

However, in doing so, it also checked for the tag on keyboard leave
events.

As a result, if the keyboard leave events is received after the X11
window is unrealized, keyboard_handle_leave() would not queue the
LeaveNotify events for the DIX to proceed, and the key repeat would
kick in and repeat the key event indefinitely.

A vulnerability was found in vim and classified as problematic. Affected by this issue is the function 
qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use 
after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. 
The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected 
component. The identifier of this vulnerability is VDB-212324.

The OpenSSL Project team has announced that, on November 1, 2022, they will 
release OpenSSL version 3.0.7, which will fix a critical vulnerability in the
popular open-source cryptographic library (but does not affect OpenSSL versions before 3.0).

This breaks certain apps, e.g. KDE System Settings when launched from
overview effect.

We're setting this env variable because earlier we used it to force kwin to use 
its special QPA so we need to change that back to something sensible.

However setting it to Wayland breaks apps that ship their own Qt with missing or 
broken Wayland support.

Set it to be empty instead. Well-behaved Qt apps will use Wayland regardless 
because of XDG_SESSION_TYPE.

29 septembre 2021

This is the first step in transitioning from the old CVE.MITRE.ORG website. 
The phased quarterly transition process began today and will last for up to one year. 
During the quarterly transition, new releases of this website will occur every quarter, 
and the new CVE.ORG website will operate concurrently with the CVE.MITRE.ORG website. 
Upon completion of the phased transition, the CVE.MITRE.ORG website will be archived and retired.

cve.mitre.org. PR_CONNECT_RESET_ERROR

stable:    5.19.17  [EOL] Source ChangeLog [CVE] 2022-10-24

Where:

CVE="CVE-2022-1184"

Link is:
https://www.cve.org/CVERecord?id=${CVE}

Example:
https://www.cve.org/CVERecord?id=CVE-2022-1184