Re: [BLFS Trac] #23697: libXfont2-2.0.9 (Xorg library)

This is a multi-part message in MIME format...

------------=_1785952581-1024790-8037
Content-Type: multipart/related;
 boundary="===============3034590044430427040=="

--===============3034590044430427040==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

#23697: libXfont2-2.0.9 (Xorg library)
-------------------------+------------------------
 Reporter:  Bruce Dubbs  |       Owner:  blfs-book
     Type:  enhancement  |      Status:  new
 Priority:  elevated     |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  medium       |  Resolution:
 Keywords:               |
-------------------------+------------------------
Changes (by Joe Locash):

 * priority:  normal => elevated
 * severity:  normal => medium

Comment:

 {{{
 libXfont2 2.0.9 is now available

 This release contains the fixes for the issues reported in today's
 security advisory:
 https://lists.x.org/archives/xorg-announce/2026-August/003734.html

 - CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write
 - CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer
 Overflow

 Additionally, it changes a build-time default. Previously fontserver
 support
 was compiled in by default unless --disable-fc was provided at configure
 time.
 The new default is *disabled by default* unless --enable-fc is provided at
 configure time. Doing so protects us from future fontserver-connection
 related
 issues. Fontservers have been deprecated for many years and the vast
 majority
 of users will not notice this changed default (Debian has built with
 --disable-fc for years).

 Peter Hutterer (5):
       README: fix documentation for --enable-snfformat
       Disable fontserver support by default
       fserve: validate num_chars against encoding array size in
 fs_read_glyphs
       fserve: bounds-check cumulative glyph data writes in fs_read_glyphs
       libXfont2 2.0.9

 git tag: libXfont2-2.0.9
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23697#comment:1>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

--===============3034590044430427040==--

------------=_1785952581-1024790-8037
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page

------------=_1785952581-1024790-8037--