Your message dated Tue, 27 Oct 2026 07:49:43 +0000
with message-id <[email protected]>
and subject line Bug#1148965: fixed in libxi 2:1.8.4-1
has caused the Debian Bug report #1148965,
regarding libxi: CVE-2026-93541 CVE-2026-93542 CVE-2026-93543 CVE-2026-93544
CVE-2026-93545 CVE-2026-94281 CVE-2026-94282
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148965: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148965
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libxi
Version: 2:1.8.2-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for libxi.
CVE-2026-93541[0]:
| An out-of-bounds read in libXi's XQueryDeviceState() in libXi before
| 1.8.4 could be used by a
CVE-2026-93542[1]:
| An out-of-bounds read in libXi's XI2 class parsing via
| size_classes() and copy_classes() in libXi before 1.8.4 could be
| used by malicous servers to crash the X client.
CVE-2026-93543[2]:
| An out-of-bounds read in libXi's XI2 class parser in libXi before
| 1.8.4 could be used by malicious X servers to crash an attached X
| client.
CVE-2026-93544[3]:
| An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in
| libXi before 1.8.4 can be used by a malicious X server to crash an
| attached X client.
CVE-2026-93545[4]:
| An out-of-bounds read in libXi's XListInputDevices() in libXi before
| 1.8.4 could be used by malicious X servers to crash an attached X
| client.
CVE-2026-94281[5]:
| An out-of-bounds read in libXi's XListInputDevices() class parsing
| in libXi before 1.8.4 could be used by malicious X servers to crash
| an attached X client.
and CVE-2026-94282[6].
They are all handled in the not yet merged MR upstream at [7].
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-93541
https://www.cve.org/CVERecord?id=CVE-2026-93541
[1] https://security-tracker.debian.org/tracker/CVE-2026-93542
https://www.cve.org/CVERecord?id=CVE-2026-93542
[2] https://security-tracker.debian.org/tracker/CVE-2026-93543
https://www.cve.org/CVERecord?id=CVE-2026-93543
[3] https://security-tracker.debian.org/tracker/CVE-2026-93544
https://www.cve.org/CVERecord?id=CVE-2026-93544
[4] https://security-tracker.debian.org/tracker/CVE-2026-93545
https://www.cve.org/CVERecord?id=CVE-2026-93545
[5] https://security-tracker.debian.org/tracker/CVE-2026-94281
https://www.cve.org/CVERecord?id=CVE-2026-94281
[6] https://security-tracker.debian.org/tracker/CVE-2026-94282
https://www.cve.org/CVERecord?id=CVE-2026-94282
[7] https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libxi
Source-Version: 2:1.8.4-1
Done: Emilio Pozuelo Monfort <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libxi, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emilio Pozuelo Monfort <[email protected]> (supplier of updated libxi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 26 Oct 2026 19:58:16 +0100
Source: libxi
Architecture: source
Version: 2:1.8.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <[email protected]>
Changed-By: Emilio Pozuelo Monfort <[email protected]>
Closes: 1148965
Changes:
libxi (2:1.8.4-1) unstable; urgency=medium
.
* New upstream release (closes: #1148965)
- CVE-2026-93541: OOB read in XQueryDeviceState().
- CVE-2026-93542: OOB read in XI2 class parsing via size_classes()
and copy_classes().
- CVE-2026-93543: OOB read in XI2 class parser.
- CVE-2026-93544: OOB read in XI2 XIQueryDevice reply parsing.
- CVE-2026-93545: OOB read in XListInputDevices()
- CVE-2026-94281: OOB read in XListInputDevices() class parsing.
- CVE-2026-94282: OOB read in XI2 enter/leave/focus cookie conversion.
- CVE-2026-109089: XGetDeviceControl Control Type Mismatch Heap Buffer
Overflow
- CVE-2026-109090: XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
* Update signing-key.asc.
Checksums-Sha1:
955afc3526026fdf6b650a635140e6fbbfe9866f 2068 libxi_1.8.4-1.dsc
32de6d6cfabadf61eaff9d4460d0e38d48ba5da4 422212 libxi_1.8.4.orig.tar.xz
2570f8c99267e8f7d97d0744bf1f5df236188af7 23348 libxi_1.8.4-1.debian.tar.xz
72eb784e2e9ce99b2d2536910f03d4a306b44b77 6739 libxi_1.8.4-1_source.buildinfo
Checksums-Sha256:
82025749283a2231866439499d86655c82f8154ae26d8b20ce1c18fe034f596f 2068
libxi_1.8.4-1.dsc
ddd6057b89a91903bc2f884d55c8467440906945e482c36547260dff28661afc 422212
libxi_1.8.4.orig.tar.xz
9720c170c270c313be1c4422cc2ac8a1eb5872dbf943603a7f012a64f2bf1bff 23348
libxi_1.8.4-1.debian.tar.xz
d3626a4d8a27a780d4b6f5ffbb163ce737677a681529a0fd8b72c3b7a2b85163 6739
libxi_1.8.4-1_source.buildinfo
Files:
8fa7d575406005774cd1f6ba0c9003b4 2068 x11 optional libxi_1.8.4-1.dsc
a3a7b2bb83b41ba278e5892a8352a469 422212 x11 optional libxi_1.8.4.orig.tar.xz
4e59214c7efbdd647113fe110b2e8fef 23348 x11 optional libxi_1.8.4-1.debian.tar.xz
fa4d7ef93234c597a2c9425b604611c7 6739 x11 optional
libxi_1.8.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmrgUqsACgkQnUbEiOQ2
gwJVAxAAj1gVcYodiV4XPaYrBpnPeM+MDSlAxAezzuwuaOs0T07ocF6i6stE+adb
JzA4UVZmlE1K2ErMxJ91va/2tLt6DmAWHNJ8dly+fvgGGKGMPWuFbvCcn5Nt4ZIn
ebW3QEAwTMOAwixIKHptwUKuAgyqodmq+Ms4fJBPTFYM7gCyDqpKvE/3Snp/HJ6n
9njyX1W9Ke6zKrWRDjlAztcv3xz6mo2zejIDQDtF2kwFMDFR45mbzdL5e191smLe
N/DnGCl/vwN2pOCCmQ2hqkK4UFXho6jiRawGngNjtsr2zYRpxqEAZPL61M8m2ybQ
Nw2S20iPd6OSS5RW7QWe7bLx1g3pQKtSPtd98Out3vdcYS/IQf0WJyFVLWoNvRPg
YsELVI8kePLVSEXd5qtzOj9cwLs6l14GjrQZ995dZkW8GcckfVGt5S6pHxV6sUOU
s+/p0iZX++cH0SZK6EG/l90DgzLXnXj/H8+wKQMo+EXrMCRPr4NOcAdscF2Rxpab
QhuSmWiEazKXQtMS1che9blDxE1W7qQAcQAveQQqGBjReZVVOFYq6Aoj2LENyluE
W0cSqr2vUB4vCjwKKHGXDrHw8aY8Bt1F18dVf4g2stErCpCAdfEgz8xqVXkHf7X1
KZsUzFPOmJVglkc6ZGPOduOlsA4m1ebWcgce5bhP/Pnr3n0W5/w=
=NVJp
-----END PGP SIGNATURE-----
pgpwXzxqbWPcp.pgp
Description: PGP signature
--- End Message ---
