Bug#1141703: marked as done (xorg-server: CVE-2026-55999 CVE-2026-56000)

This is a multi-part message in MIME format...

------------=_1785926342-4024267-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Wed, 05 Aug 2026 10:36:32 +0000
with message-id <[email protected]>
and subject line Bug#1141703: fixed in xorg-server 2:21.1.24-1
has caused the Debian Bug report #1141703,
regarding xorg-server: CVE-2026-55999 CVE-2026-56000
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
1141703: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1141703
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1785926342-4024267-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 9 Jul 2026 03:50:53 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
	NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 21; hammy, 149; neutral, 42; spammy,
	1. spammytokens:0.941-+--H*r:bugs.debian.org
	hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc,
	0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug, 0.000-+--H*Ad:N*Tracking
Return-path: <[email protected]>
Received: via submission
	by buxtehude.debian.org with esmtp (Exim 4.96)
	(envelope-from <[email protected]>)
	id 1whfmm-00FVma-2p
	for [email protected];
	Thu, 09 Jul 2026 03:50:53 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: xorg-server: CVE-2026-55999 CVE-2026-56000
Message-ID: <178356905200.879379.7737221237056729066.reportbug@elende.valinor.li>
X-Mailer: reportbug 13.2.0+nmu1
Date: Thu, 09 Jul 2026 05:50:52 +0200
Delivered-To: [email protected]

U291cmNlOiB4b3JnLXNlcnZlcgpWZXJzaW9uOiAyOjIxLjEuMjMtMQpTZXZlcml0eTogZ3JhdmUK
VGFnczogc2VjdXJpdHkgdXBzdHJlYW0KSnVzdGlmaWNhdGlvbjogdXNlciBzZWN1cml0eSBob2xl
ClgtRGViYnVncy1DYzogY2FybmlsQGRlYmlhbi5vcmcsIERlYmlhbiBTZWN1cml0eSBUZWFtIDx0
ZWFtQHNlY3VyaXR5LmRlYmlhbi5vcmc+CkNvbnRyb2w6IGZvdW5kIC0xIDI6MjEuMS4xNi0xCgpI
aSwKClRoZSBmb2xsb3dpbmcgdnVsbmVyYWJpbGl0aWVzIHdlcmUgcHVibGlzaGVkIGZvciB4b3Jn
LXNlcnZlci4KCkNWRS0yMDI2LTU1OTk5WzBdOgp8IExvY2FsIGF0dGFja2VycyB3aXRoIGEgWCBj
b25uZWN0aW9uIGFibGUgdG8gcHJvdmlkZSBQQ1ggZm9udHMgdG8gdGhlCnwgWCAgc2VydmVyIHhv
cmctc2VydmVyIGJlZm9yZSAyMS4yLjI0IGFuZCB4d2F5bGFuZCBiZWZvcmUgMjQuMS4xMwp8IGNv
dWxkICBjYXVzZSBhIGhlYXAgYnVmZmVyIG92ZXJmbG93IHZpYSBTZXRGb250IGR1ZSB0byBtaXNz
aW5nIGdseXBoCnwgYm91bmRhcnkgY2hlY2tzLgoKCkNWRS0yMDI2LTU2MDAwWzFdOgp8IExvY2Fs
IGF0dGFja2VycyB3aXRoIGEgWCBjb25uZWN0aW9uIGFibGUgdG8gcHJvdmlkZSBHTFggY29tbWl0
IHRvCnwgdGhlIFggc2VydmVyIHhvcmctc2VydmVyIGJlZm9yZSAyMS4yLjI0IGFuZCB4d2F5bGFu
ZCBiZWZvcmUgMjQuMS4xMwp8IGNvdWxkIGNhdXNlIGEgSGVhcCBVc2UgQWZ0ZXIgRnJlZSwgZHVl
IHRvwqBDb21tb25NYWtlQ3VycmVudCgpCnwgcG9pbnRpbmcgaW50byBwb3RlbnRpYWxseSByZWFs
bG9jYXRlZCBtZW1vcnkuCgoKSWYgeW91IGZpeCB0aGUgdnVsbmVyYWJpbGl0aWVzIHBsZWFzZSBh
bHNvIG1ha2Ugc3VyZSB0byBpbmNsdWRlIHRoZQpDVkUgKENvbW1vbiBWdWxuZXJhYmlsaXRpZXMg
JiBFeHBvc3VyZXMpIGlkcyBpbiB5b3VyIGNoYW5nZWxvZyBlbnRyeS4KCkZvciBmdXJ0aGVyIGlu
Zm9ybWF0aW9uIHNlZToKClswXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90
cmFja2VyL0NWRS0yMDI2LTU1OTk5CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9p
ZD1DVkUtMjAyNi01NTk5OQpbMV0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcv
dHJhY2tlci9DVkUtMjAyNi01NjAwMAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/
aWQ9Q1ZFLTIwMjYtNTYwMDAKWzJdIGh0dHBzOi8vd3d3Lm9wZW53YWxsLmNvbS9saXN0cy9vc3Mt
c2VjdXJpdHkvMjAyNi8wNy8wOC8yCgpQbGVhc2UgYWRqdXN0IHRoZSBhZmZlY3RlZCB2ZXJzaW9u
cyBpbiB0aGUgQlRTIGFzIG5lZWRlZC4KClJlZ2FyZHMsClNhbHZhdG9yZQo=

------------=_1785926342-4024267-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 1141703-close) by bugs.debian.org; 5 Aug 2026 10:36:34 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,
	HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST
	autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 100; hammy, 150; neutral, 133; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload,
	0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo
Return-path: <[email protected]>
Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:39120)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wrYzC-00GsWr-06
	for [email protected];
	Wed, 05 Aug 2026 10:36:34 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wrYzB-001RMo-2U
	for [email protected];
	Wed, 05 Aug 2026 10:36:33 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=E9YQixcP36oBT3t+Itq3EwiwBHpANba2rQOj5qtLCyo=; b=fSwqECe6kzxbjt/p+IZuQ6YtWy
	vdWDgfN0tmtPtsAwvlLfOiHWjEj9k49s/sTB0JmefiYSKTu6fOvu1YERMbD8bR3aAK9qXkNYfHWfU
	BEcI+Jk2g4xy9Dp9kYCasXnJjjsInFHlFLvSgNgR/SG+hX86RFIa7m5zmUHYl0CvcG2p2LmQPdS48
	UrKzMY+aUK6A4aTE16rO9JNpGfG1JE3CaWV4coxv8TYVf0yFyFz6jdfx9MC4Pknq4t4sQLKByAMn5
	/UBrkiqyJbZFS0eGZJPYdFpNjUOF/2FoSpmm42Ql9/Z5iNwBsEXH96d7oGzchIwTbz0PgFZ891iwk
	bZ+ZndFA==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1wrYzA-0000000Eljl-42G3;
	Wed, 05 Aug 2026 10:36:32 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: Emilio Pozuelo Monfort <[email protected]>
To: [email protected]
X-DAK: dak process-upload
X-Debian: DAK
X-Debian-Package: xorg-server
Debian: DAK
Debian-Changes: xorg-server_21.1.24-1_source.changes
Debian-Source: xorg-server
Debian-Version: 2:21.1.24-1
Debian-Architecture: source
Debian-Suite: unstable
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#1141703: fixed in xorg-server 2:21.1.24-1
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============1799049685156843162=="
Message-Id: <[email protected]>
Date: Wed, 05 Aug 2026 10:36:32 +0000

--===============1799049685156843162==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: xorg-server
Source-Version: 2:21.1.24-1
Done: Emilio Pozuelo Monfort <[email protected]>

We believe that the bug you reported is fixed in the latest version of
xorg-server, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emilio Pozuelo Monfort <[email protected]> (supplier of updated xorg-server pa=
ckage)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 05 Aug 2026 12:04:38 +0200
Source: xorg-server
Architecture: source
Version: 2:21.1.24-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <[email protected]>
Changed-By: Emilio Pozuelo Monfort <[email protected]>
Closes: 1141703
Changes:
 xorg-server (2:21.1.24-1) unstable; urgency=3Dmedium
 .
   * Team upload.
   * New upstream release.
     -  CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow
     -  CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent()
     Closes: #1141703.
Checksums-Sha1:
 4d1bcd1a04a34ad9a14b7001a193c929eb91cf84 4040 xorg-server_21.1.24-1.dsc
 2301d8084a777b942f3d7e3860a506c855986996 9036382 xorg-server_21.1.24.orig.ta=
r.gz
 8130aaa668b7e2d49859c0b27201b5d3cb59dbb9 178470 xorg-server_21.1.24-1.diff.gz
 3deb538ad45c7289b8e6af0da106c797460265e9 9435 xorg-server_21.1.24-1_source.b=
uildinfo
Checksums-Sha256:
 03e384de62bdbe4a5830e19f73fa0fdda97f7071f1cdd56ea18e2335613aa0f6 4040 xorg-s=
erver_21.1.24-1.dsc
 d01ccd7ba48ec9d6815aeef5fb408d0c307ab6be21d20ff0b54b11f1c2b8a075 9036382 xor=
g-server_21.1.24.orig.tar.gz
 d0c8e5abf7ca569d08b2ecde7f45e4178d28b415113844ce5a0395c10ac6e91a 178470 xorg=
-server_21.1.24-1.diff.gz
 b25510af9b80653a1579c67d1be3944c0592b4353495f6b94005503e1a2ec119 9435 xorg-s=
erver_21.1.24-1_source.buildinfo
Files:
 20a7f5bfc808bfbb7cec06996a0d0e50 4040 x11 optional xorg-server_21.1.24-1.dsc
 f6e5b3ae9013a4b926a31d11c5656202 9036382 x11 optional xorg-server_21.1.24.or=
ig.tar.gz
 e12e06170600d4e704f61ebc2771c1df 178470 x11 optional xorg-server_21.1.24-1.d=
iff.gz
 9a20e6a2ed9444e598f9a4f49aa8f8c8 9435 x11 optional xorg-server_21.1.24-1_sou=
rce.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmpzCxEACgkQnUbEiOQ2
gwJBYxAAg4Hs2xJW97KyEZFZJvMHm94XzEGuXcu2wmTLRRfNhSkbLpymp6JzvhKJ
721w6/y8K0BNguB4fdxlfe4SNItooho/4SF7BVqlD4wAMpSQDtB7haNh6m0RrvOO
AwM34zG++V3GeUhaaaDYhgieMSSeayYbJW33DnYr32+TeNWmkHVCTabOhsE5PWlW
si1HOrUqT+1O4CezOts+FdawyVlWtSUcYAMHoPk3MBCbud5OaPngAmLFL+p7zzvK
9uCUXiuhSuBK6in02ND9Y2SyN8mNw+HWco+bOtp26VdGf9ks4u1EJVNhrcrmZzKC
u5TEBssTK+PUf1S3bCLiOBgZHwdGDAq9e5AMIoVeIp/wj8m3SOLxmbsXRReiDhsW
LQRiRy5oNPAjCGhJU7qGLRSu01pRZX2at5NyK4iPl72TnQEGQOl1ZZqe+Y/AaqBr
B3f9FjZEPtZpTaDSerhnXWU+Oz77N5+FQeUitYjAXHx7eQzArLId62Pl4MtFkOo1
ZzGjfAyOaG4JDuk4Io6uDnndDwjjzN9MJDJzT02AJBtN5BGItWaPiss0nHqoIYcx
nUmi9+9ZTSKkmxd5CNqtq2EE69bdd7kbGYuLQSBDejYKurkDfTdABjKMXTaFaNnT
PLh1rKNKHNCzKyidLdxHUf1gh3QtsGlAGdLYx2eOnOtwc2PvYXk=3D
=3DwwW2
-----END PGP SIGNATURE-----


--===============1799049685156843162==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanMSMAAKCRCb9qggYcy5
IR1aAQDyT21ZuXuHRlRSmpJ5OIpNWOEOMv56niCBEPXIX9PcPQD/VHOr2Gmwb60c
Jp/MxLwBg8l+sKo78ExfBxHjLmW3wg4=
=wb+B
-----END PGP SIGNATURE-----

--===============1799049685156843162==--
------------=_1785926342-4024267-0--