Bug#1141702: marked as done (libxfont: CVE-2026-56001 CVE-2026-56002 CVE-2026-56003)

This is a multi-part message in MIME format...

------------=_1784119742-2821072-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Wed, 15 Jul 2026 12:47:06 +0000
with message-id <[email protected]>
and subject line Bug#1141702: fixed in libxfont 1:2.0.6-1+deb13u1
has caused the Debian Bug report #1141702,
regarding libxfont: CVE-2026-56001 CVE-2026-56002 CVE-2026-56003
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
1141702: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1141702
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1784119742-2821072-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 9 Jul 2026 03:49:21 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
	NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 27; hammy, 139; neutral, 37; spammy,
	1. spammytokens:0.941-+--H*r:bugs.debian.org
	hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc,
	0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug, 0.000-+--H*Ad:N*Tracking
Return-path: <[email protected]>
Received: via submission
	by buxtehude.debian.org with esmtp (Exim 4.96)
	(envelope-from <[email protected]>)
	id 1whflJ-00FVYq-1p
	for [email protected];
	Thu, 09 Jul 2026 03:49:21 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: libxfont: CVE-2026-56001 CVE-2026-56002 CVE-2026-56003
Message-ID: <178356895482.879191.16643688598112210278.reportbug@elende.valinor.li>
X-Mailer: reportbug 13.2.0+nmu1
Date: Thu, 09 Jul 2026 05:49:14 +0200
Delivered-To: [email protected]

U291cmNlOiBsaWJ4Zm9udApWZXJzaW9uOiAxOjIuMC42LTEKU2V2ZXJpdHk6IGdyYXZlClRhZ3M6
IHNlY3VyaXR5IHVwc3RyZWFtCkp1c3RpZmljYXRpb246IHVzZXIgc2VjdXJpdHkgaG9sZQpYLURl
YmJ1Z3MtQ2M6IGNhcm5pbEBkZWJpYW4ub3JnLCBEZWJpYW4gU2VjdXJpdHkgVGVhbSA8dGVhbUBz
ZWN1cml0eS5kZWJpYW4ub3JnPgoKSGksCgpUaGUgZm9sbG93aW5nIHZ1bG5lcmFiaWxpdGllcyB3
ZXJlIHB1Ymxpc2hlZCBmb3IgbGlieGZvbnQuCgpDVkUtMjAyNi01NjAwMVswXToKfCBBIGhlYXAg
YnVmZmVyIG92ZXJmbG93IGluIEJpdG1hcFNjYWxlQml0bWFwcyBpbiBsaWJYZm9udDIgYmVmb3Jl
CnwgMi4wLjggZHVlIHRvIGFuIG92ZXJmbG93aW5nIDMyYml0IHNpemUgY291bGQgYmUgdXNlZCBi
eSBhdHRhY2tlcnMKfCBhYmxlIHRvIGFjY2VzcyB0aGUgWCBTZXJ2ZXIgdG8gZXhlY3V0ZSBjb2Rl
IHdpdGhpbiB0aGUgWCBzZXJ2ZXIgY29udAoKCkNWRS0yMDI2LTU2MDAyWzFdOgp8IEEgaGVhcCBi
dWZmZXJmbG93IGluIHBjZlJlYWRGb250KCkgZHVlIHRvIG1pc3NpbmcgZ2x5cGggYm91bmRzCnwg
Y2hlY2tpbmfCoGluIGxpYlhmb250MiBiZWZvcmUgMi4wLjjCoCBhbGxvd3MgYXR0YWNrZXJzIGF1
dGhlbnRpY2F0ZWQKfCBhcyBYIGNsaWVudCB0byBleGVjdXRlIGNvZGUgd2l0aGluIHRoZSBYIHNl
cnZlci4KCgpDVkUtMjAyNi01NjAwM1syXToKfCBBIGhlYXAgYnVmZmVyIG92ZXJmbG93IGR1ZSB0
byBtaXNzaW5nIHNpemUgY2hlY2tpbmcgaW4gdGhlIHByb3BlcnR5CnwgYnVmZmVyIHdoZW4gcGFy
c2luZyBQQ0YgZmlsZXMgaW4gbGliWGZvbnQyIENvbXB1dGVTY2FsZWRQcm9wZXJ0aWVzKCkKfCBi
ZWZvcmUgbGliWGZvbnQyIGJlZm9yZSAyLjAuOCBjb3VsZCBiZSB1c2VkIGJ5IGF0dGFja2VycyB1
c2luZwp8IGF1dGhlbnRpY2F0ZWQgWCBjbGllbnRzIHRvIGV4ZWN1dGUgY29kZSB3aXRoaW4gdGhl
IFggc2VydmVyLgoKCklmIHlvdSBmaXggdGhlIHZ1bG5lcmFiaWxpdGllcyBwbGVhc2UgYWxzbyBt
YWtlIHN1cmUgdG8gaW5jbHVkZSB0aGUKQ1ZFIChDb21tb24gVnVsbmVyYWJpbGl0aWVzICYgRXhw
b3N1cmVzKSBpZHMgaW4geW91ciBjaGFuZ2Vsb2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZvcm1h
dGlvbiBzZWU6CgpbMF0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tl
ci9DVkUtMjAyNi01NjAwMQogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZF
LTIwMjYtNTYwMDEKWzFdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNr
ZXIvQ1ZFLTIwMjYtNTYwMDIKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNW
RS0yMDI2LTU2MDAyClsyXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFj
a2VyL0NWRS0yMDI2LTU2MDAzCiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1D
VkUtMjAyNi01NjAwMwpbM10gaHR0cHM6Ly93d3cub3BlbndhbGwuY29tL2xpc3RzL29zcy1zZWN1
cml0eS8yMDI2LzA3LzA4LzEKClJlZ2FyZHMsClNhbHZhdG9yZQo=

------------=_1784119742-2821072-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 1141702-close) by bugs.debian.org; 15 Jul 2026 12:47:09 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,
	FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,
	SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham
	autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 81; hammy, 150; neutral, 182; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--H*r:sk:fasolo.,
	0.000-+--H*MI:fasolo, 0.000-+--H*m:fasolo
Return-path: <[email protected]>
Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:56376)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wjz13-00BpXk-0C
	for [email protected];
	Wed, 15 Jul 2026 12:47:09 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wjz11-0040eu-2c
	for [email protected];
	Wed, 15 Jul 2026 12:47:07 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=VSnt0N+ZXUFtPVXvB1iPW2wVvrnPlRxT7gfBWjLL1ak=; b=qmn0LthjYDgRKMtZv6i2QNVMAo
	ltYJSxAJ8c5ENmvCC6ElT0WimlSUeCBxrTLTDTDgHtvpbZlOduU+rkdV35dfeXgnJXn2HqrVwU9mi
	Loj/52knxIJjnPJNMTiUrQvlzU9bRSXD5zyXP5jmHEujgeKSlI2tkGwejYM3uRktDflxvyl0hqpIN
	jpF5Iv0WtNa37cu3CJmZZ2Qpa4jc+sQwFbTk9gdHN2PK5RVD8W7g3HUMC6wBcVwBFqCS/cL3+wTlg
	iFAxJPZ91ItPNCAXKMdx7S+2YarcPA+d4yTQvKQnwzBYiZbjZatQyhO0r1aa24pPe5GG8RckS63RK
	d9Jzq76A==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1wjz10-000000083wR-3zNe;
	Wed, 15 Jul 2026 12:47:06 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: Salvatore Bonaccorso <[email protected]>
To: [email protected]
X-DAK: dak process-policy
X-Debian: DAK
X-Debian-Package: libxfont
Debian: DAK
Debian-Changes: libxfont_2.0.6-1+deb13u1_source.changes
Debian-Source: libxfont
Debian-Version: 1:2.0.6-1+deb13u1
Debian-Architecture: source
Debian-Suite: proposed-updates
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#1141702: fixed in libxfont 1:2.0.6-1+deb13u1
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============2907906044338406793=="
Message-Id: <[email protected]>
Date: Wed, 15 Jul 2026 12:47:06 +0000

--===============2907906044338406793==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: libxfont
Source-Version: 1:2.0.6-1+deb13u1
Done: Salvatore Bonaccorso <[email protected]>

We believe that the bug you reported is fixed in the latest version of
libxfont, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated libxfont packag=
e)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 10 Jul 2026 14:32:27 +0200
Source: libxfont
Architecture: source
Version: 1:2.0.6-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian X Strike Force <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1141702
Changes:
 libxfont (1:2.0.6-1+deb13u1) trixie-security; urgency=3Dhigh
 .
   * Non-maintainer upload by the Security Team.
   * bitscale: fix integer overflow in BitmapScaleBitmaps bytestoalloc
     (CVE-2026-56001) (Closes: #1141702)
   * pcfread: validate bitmap sizes and offsets against per-glyph metrics
     (CVE-2026-56002) (Closes: #1141702)
   * bitscale: add bounds check to computeProps for property buffer
     (CVE-2026-56003) (Closes: #1141702)
Checksums-Sha1:
 36340833ad9b8be9db989076f454a42f45e57e09 2581 libxfont_2.0.6-1+deb13u1.dsc
 75bfe18f3c528bfb0de0ec5d10594aa90d609aeb 635826 libxfont_2.0.6.orig.tar.gz
 62797fc17e7ba3799a5bacf07d153d5ae65ccb82 801 libxfont_2.0.6.orig.tar.gz.asc
 81931f26fffc9c3ac8b7769729ec37954987394b 38890 libxfont_2.0.6-1+deb13u1.diff=
.gz
 0b56bb4c7c15dae227ea42fd31f38d01101bdc13 6431 libxfont_2.0.6-1+deb13u1_sourc=
e.buildinfo
Checksums-Sha256:
 25d131fff652df5f70d16da165ba7f79d360cb52ce5773faa07216036817e7c8 2581 libxfo=
nt_2.0.6-1+deb13u1.dsc
 a944df7b6837c8fa2067f6a5fc25d89b0acc4011cd0bc085106a03557fb502fc 635826 libx=
font_2.0.6.orig.tar.gz
 debee1347d3e220968308a87155f7ea517d531a5298e668e54dfab9bf2813d1e 801 libxfon=
t_2.0.6.orig.tar.gz.asc
 ed42ef32c50c805cb420c9c96acc61af5ec297658d4e59735ab2e83b96243552 38890 libxf=
ont_2.0.6-1+deb13u1.diff.gz
 e18be910a922781865aac0ecc5f196370f9f99c78bd3b52fe9a8e680da33ec21 6431 libxfo=
nt_2.0.6-1+deb13u1_source.buildinfo
Files:
 752cc5f67d38803a61a52ed4ed8afeb0 2581 x11 optional libxfont_2.0.6-1+deb13u1.=
dsc
 f3dc322ffcf16db5cedccbb41423b2da 635826 x11 optional libxfont_2.0.6.orig.tar=
.gz
 4942e38ca467c1801cfd7407e6687f21 801 x11 optional libxfont_2.0.6.orig.tar.gz=
.asc
 0857e14d77702a7208248c510628c7f2 38890 x11 optional libxfont_2.0.6-1+deb13u1=
.diff.gz
 7d61402d9ed50abd86c205490566569e 6431 x11 optional libxfont_2.0.6-1+deb13u1_=
source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmpT8WVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E+nIP/00kwzyvxaOddQk+3xba6Ov9NMdKBpK6
VTqOZF1y5AwwE4VBRCHHAXozbPWfHIX5Xy+2TCK0VMAUtujHqNqQeNXCyHsHsfMI
JjcYkC+1YllKbSLHft2DxCsMdUj/mWtseEfBHaCB6nULfRnlMwAAF6zruDGjN6+I
ImEasCmJyaxCe3ud5cy6cSXjjp7tHEfNOKLWOvFg098kHagfbDVLYUEelTnC2j66
vl9dhpTB9NBxjtcuXLdHpZwQJy0Kyl9KJrdO9VXcTqsk0quvmpEbuuy2WwSpLg3p
iP0wrgdCut2elR2VAajTK4UPaezqTkMJeM+YsIVQ9EVOlNjnX4r5dSNfOfwgtmKV
Mns4eds3Djln/oM1KcdnUHkHbqX4PJNwGWRX023muD0vg+yO+fv3RW1rsTU/QWYF
QyrTF0zQS5rNKuTJL42ZMz/B4ZveDPy7srmO48wkkaa7hZ/3QdDBlxw1CUXqKMGa
lolJ6bVz501i6yWNH2ooAQJqpisHUiGhPJzrNPa9F/Rg43751Y5yIznKg3MVkBft
LmIULz8V2vfJmpJuKuyFOBL5WFaS6WRSdPAcAD7jtDy/zXFwm464SugdTR8sQkvF
PRtWARRV4ChDgbttkX5sLKKERnjI+fOodTcxxN5nFGkagrsdgH7i22Ks5z88/CHl
h+YN9VgACQfy
=3DGMfo
-----END PGP SIGNATURE-----


--===============2907906044338406793==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaleBSgAKCRCb9qggYcy5
IYoPAP9zcKNOLkEqC1ZSlaXCL1itCJ7G+PLHXxVm2zkUVWv7XQD/S2ZSq1tqhW6X
bcUtZeNHFXmJMCubMc+9Dan7+bEiNwM=
=y/wL
-----END PGP SIGNATURE-----

--===============2907906044338406793==--
------------=_1784119742-2821072-0--