The Xorg developers finally did some housekeeping on outstanding CVEs in X11.

[reaperx7]

https://www.gamingonlinux.com/2025/06/multiple-security-issues-in-the-x-org-x-server-and-xwayland-disclosed-new-versions-released/

Apparently 6 outstanding CVEs were merged into the xorg tree by FreeDesktops. I honestly, wonder if this is a knee jerk reaction xlibre getting development going.

Full announcement was made here:

https://lists.x.org/archives/xorg-announce/2025-June/003608.html

Was curious if these would affect xlibre in any way.

[callmetango]

Thank you very much for reporting this! The patches were included in the XLibre Xserver as follows:

• render: fix CVE-2025-49175 · X11Libre/xserver@c430c82
• os: Check for integer overflow on BigRequest length · X11Libre/xserver@899afa4
• os: Do not overflow the integer size with BigRequest · X11Libre/xserver@3151e48
• xfixes: Check request length for SetClientDisconnectMode · X11Libre/xserver@a1e44d3
• os: Account for bytes to ignore when sharing input buffer · X11Libre/xserver@0d6af5a
• record: Check for overflow in RecordSanityCheckRegisterClients() · X11Libre/xserver@da5f8d1
• randr: Check for overflow in RRChangeProviderProperty() · X11Libre/xserver@948630f
• xfree86: Check for RandR provider functions · X11Libre/xserver@923837e