• z3rOR0ne@lemmy.ml
    link
    fedilink
    arrow-up
    18
    ·
    7 months ago

    So if I’m reading this correctly, three of them have already been patched and the other has also been patched, but has an optional config flag you must enable to enable the patch and fix the security vulnerability?

    • metiulekm@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      17
      ·
      7 months ago

      My understanding is that all issues are patched in the mentioned releases, the config flag is not needed for that.

      The config flag has been added because supporting clients with different endianness is undertested and most people will never use it. So if it is going to generate vulnerabilities, it makes sense to be able to disable it easily, and to disable it by default on next major release. Indeed XWayland had it disabled by default already, so only the fourth issue (ProcRenderAddGlyphs) is relevant there if that default is not changed.