Debian Patches

Status for spice-vdagent/0.23.0-4

Patch Description Author Forwarded Bugs Origin Last update
disable_test_session_info.patch Disable test-session-info
Requires running systemd which we don't have during the build

it with autopkgtest instead

https://gitlab.freedesktop.org/spice/linux/vd_agent/-/issues/24
https://gitlab.freedesktop.org/spice/linux/vd_agent/-/merge_requests/32		 Jeremy Bicha <jeremy.bicha@canonical.com> no 2022-02-24
CVE-2026-57965.patch fix(udscs): Prevent integer overflow in udscs_write() buf_size calculation

Add a bounds check rejecting messages where size > UINT32_MAX - sizeof(header)
before computing buf_size = sizeof(header) + size. This prevents the 32-bit
unsigned integer wraparound that leads to a tiny allocation followed by a
massive heap-buffer-overflow memcpy, crashing the daemon (DoS).		 Vinz Spring <vinzs@amazon.de> no 2026-07-17
CVE-2026-57966.patch fix(file-xfers): Reject path traversal in file transfer filenames

Add is_safe_filename() validation in vdagent_file_xfers_create_file() that
rejects filenames containing '..' path components or absolute paths. This
prevents a malicious SPICE host from writing arbitrary files outside the
intended save directory via crafted file transfer names.		 Vinz Spring <vinzs@amazon.de> no 2026-07-17
gtk4-cache.patch x11-randr: keep cache current on X11+GTK4 builds
vdagent_x11_randr_handle_root_size_change() and the RRNotify branch in
vdagent_x11_randr_handle_event() were guarded by #ifndef
USE_GTK_FOR_MONITORS, but vdagent_gtk_get_resolutions() returns NULL on
non-Wayland. So on X11+GTK4 builds the resolution-getter chain falls
back to vdagent_x11_get_resolutions(), which reads x11->width/height
cached once at startup from XGetWindowAttributes(). uinput is then sized
to that stale geometry and absolute mouse events drift from the cursor
once the X server's actual mode changes.		 ryps <ryps.sec@proton.me> no upstream, https://gitlab.freedesktop.org/spice/linux/vd_agent/-/merge_requests/58 2026-05-04
logs.patch Revert "spice-vdagent[d].service: Fix duplicated logs"
This reverts commit 8b0f9cf1e207eb1160d8b453a77b662e783ea9d7.		 Jeremy Bícha <jbicha@ubuntu.com> yes 2026-09-29

All known versions for source package 'spice-vdagent'

Links