xorg announce - Nov 2022 - [ANNOUNCE] pixman release 0.42.2 now available

A new pixman release 0.42.2 is now available. This is a stable release
in the 0.42 series.

This version contains a fix for a heap overflow. A CVE has been
requested, and I'll reply to this email with the number when it is
allocated. 

See
https://gitlab.freedesktop.org/pixman/pixman/-/commit/a1f88e842e0216a5b4df1ab023caebe33c101395
and https://gitlab.freedesktop.org/pixman/pixman/-/issues/63 for more
information.

Thanks to Maddie Stone and Google's Project Zero for discovering this
issue, providing a proof-of-concept, and a great analysis.

tar.gz:
	https://cairographics.org/releases/pixman-0.42.2.tar.gz
	https://www.x.org/releases/individual/lib/pixman-0.42.2.tar.gz

tar.xz:
	https://www.x.org/releases/individual/lib/pixman-0.42.2.tar.xz

Hashes:
	SHA256: ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e 
pixman-0.42.2.tar.gz
	SHA256: 5747d2ec498ad0f1594878cc897ef5eb6c29e91c53b899f7f71b506785fc1376 
pixman-0.42.2.tar.xz
	SHA512:
0a4e327aef89c25f8cb474fbd01de834fd2a1b13fdf7db11ab72072082e45881cd16060673b59d02054b1711ae69c6e2395f6ae9214225ee7153939efcd2fa5d
pixman-0.42.2.tar.gz
	SHA512:
3476e2676e66756b1af61b1e532cd80c985c191fb7956eb01702b419726cce99e79163b7f287f74f66414680e7396d13c3fee525cd663f12b6ac4877070ff4e8
pixman-0.42.2.tar.xz

GPG signature:
	https://cairographics.org/releases/pixman-0.42.2.tar.gz.sha512.asc
	(signed by [ultimate] Matt Turner <mattst88 at gmail.com>
	 [ultimate] Matt Turner <mattst88 at gentoo.org>
	 [ultimate] Matt Turner <mattst88 at freedesktop.org>
	 [ultimate] Matt Turner <msturner at google.com>)

Git:
	https://gitlab.freedesktop.org/pixman/pixman.git
	tag: pixman-0.42.2

Log:
	Matt Turner (4):
	      build: Add a64-neon-test.S to EXTRA_DIST
	      Revert "Fix signed-unsigned semantics in reduce_32"
	      Avoid integer overflow leading to out-of-bounds write
	      Pre-release version bump to 0.42.2
	
	Simon Ser (3):
	      Post-release version bump to 0.42.1
	      meson: override pixman-1 dependency
	      meson: explicitly set C standard to gnu99
	
	Thomas Klausner (2):
	      configure.ac: avoid unportable test(1) operator
	      Makefile.am: increase shell portability
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 376 bytes
Desc: not available
URL:
<https://lists.x.org/archives/xorg-announce/attachments/20221102/3d57d070/attachment.sig>

On Wed, Nov 2, 2022 at 1:37 PM Matt Turner <mattst88 at gmail.com>
wrote:
>
> A new pixman release 0.42.2 is now available. This is a stable release
> in the 0.42 series.
>
> This version contains a fix for a heap overflow. A CVE has been
> requested, and I'll reply to this email with the number when it is
> allocated.
This has been assigned CVE-2022-44638.