File _patchinfo of Package patchinfo.38142

<patchinfo incident="38142">
  <issue tracker="cve" id="2023-39929"/>
  <issue tracker="bnc" id="1202828">libva driver_data in vdpau_common_Initialize can have a null pointer for x11_dpy which is not checked</issue>
  <issue tracker="bnc" id="1217770">SLE15-SP6: Update components for Video (processing) hardware support on Intel GPUs</issue>
  <issue tracker="bnc" id="1224413">VUL-0: CVE-2023-39929: libva: uncontrolled search path may allow an authenticated user to escalate privilege via local access</issue>
  <issue tracker="jsc" id="PED-11066"/>
  <packager>sndirsch</packager>
  <rating>moderate</rating>
  <category>security</category>
  <summary>Security update for libva</summary>
  <description>This update for libva fixes the following issues:

Update to libva version 2.20.0, which includes security fix for:

* CVE-2023-39929: uncontrolled search path may allow an authenticated user to
  escalate privilege via local access (bsc#1224413, jsc#PED-11066)

This includes latest version of one of the components needed for Video
(processing) hardware support on Intel GPUs (bsc#1217770)

Update to version 2.20.0:

  * av1: Revise offsets comments for av1 encode
  * drm:

    - Limit the array size to avoid out of range
    - Remove no longer used helpers

  * jpeg: add support for crop and partial decode
  * trace:

    - Add trace for vaExportSurfaceHandle
    - Unlock mutex before return
    - Fix minor issue about printf data type and value range

  * va/backend:

    - Annotate vafool as deprecated
    - Document the vaGetDriver* APIs

  * va/x11/va_fglrx: Remove some dead code
  * va/x11/va_nvctrl: Remove some dead code
  * va:

    - Add new VADecodeErrorType to indicate the reset happended in
      the driver
    - Add vendor string on va_TraceInitialize
    - Added Q416 fourcc (three-plane 16-bit YUV 4:4:4)
    - Drop no longer applicable vaGetDriverNames check
    - Fix:don't leak driver names, when override is set
    - Fix:set driver number to be zero if vaGetDriverNames failed
    - Optimize code of getting driver name for all protocols/os
      (wayland,x11,drm,win32,android)
    - Remove legacy code paths
    - Remove unreachable "DRIVER BUG"

  * x11/dri2: limit the array handling to avoid out of range access
  * x11:

    - Allow disabling DRI3 via LIBVA_DRI3_DISABLE env var
    - Implement vaGetDriverNames
    - Remove legacy code paths

Update to 2.19.0:

  * add: Add mono_chrome to VAEncSequenceParameterBufferAV1
  * add: Enable support for license acquisition of multiple protected
    playbacks
  * fix: use secure_getenv instead of getenv
  * trace: Improve and add VA trace log for AV1 encode
  * trace: Unify va log message, replace va_TracePrint with va_TraceMsg.

Update to version 2.18.0:

  * doc: Add build and install libva informatio in home page.
  * fix:

    - Add libva.def into distribution package
    - NULL check before calling strncmp.
    - Remove reference to non-existent symbol

  * meson: docs:

    - Add encoder interface for av1
    - Use libva_version over project_version()

  * va:

    - Add VAProfileH264High10
    - Always build with va-messaging API
    - Fix the codying style of CHECK_DISPLAY
    - Remove Android pre Jelly Bean workarounds
    - Remove dummy isValid() hook
    - Remove unused drm_sarea.h include &amp; ANDROID references in
      va_dricommon.h
    - va/sysdeps.h: remove Android section
  * x11:
    - Allow disabling DRI3 via LIBVA_DRI3_DISABLe env var

    - Use LIBVA_DRI3_DISABLE in GetNumCandidates

- Add libva-wayland to baselibs.conf, now that its build have moved
  to the main part of spec, source validator should no longer
  complain on SLE.

Update to 2.17.0:

  * win: Simplify signature for driver name loading
  * win: Rewrite driver registry query and fix some
    bugs/leaks/inefficiencies
  * win: Add missing null check after calloc
  * va: Update security disclaimer
  * dep:remove the file .cvsignore
  * pkgconfig: add 'with-legacy' for emgd, nvctrl and fglrx
  * meson: add 'with-legacy' for emgd, nvctrl and fglrx
  * x11: move all FGLRX code to va_fglrx.c
  * x11: move all NVCTRL code to va_nvctrl.c
  * meson: stop using deprecated meson.source_root()
  * meson: stop using configure_file copy=true
  * va: correctly include the win32 (local) headers
  * win: clean-up the coding style
  * va: dos2unix all the files
  * drm: remove unnecessary dri2 version/extension query
  * trace: annotate internal functions with DLL_HIDDEN
  * build/sysdeps: Remove HAVE_GNUC_VISIBILITY_ATTRIBUTE and use _GNUC_
    support level attribute instead
  * meson: Check support for -Wl,-version-script and build link_args
    accordingly
  * meson: Set va_win32 soversion to '' and remove the install_data rename
  * fix: resouce check null
  * va_trace: Add Win32 memory types in va_TraceSurfaceAttributes
  * va_trace: va_TraceSurfaceAttributes should check the
    VASurfaceAttribMemoryType
  * va: Adds Win32 Node and Windows build support
  * va: Adds compat_win32 abstraction for Windows build and prepares va
    common code for windows build
  * pkgconfig: Add Win32 package for when WITH_WIN32 is enabled
  * meson: Add with_win32 option, makes libdrm non-mandatory on Win
  * x11: add basic DRI3 support
  * drm: remove VA_DRM_IsRenderNodeFd() helper
  * drm: add radeon drm + radeonsi mesa combo
</description>
</patchinfo>