-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4678-1 [email protected]
https://www.debian.org/lts/security/ Andrej Shadura
July 12, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : libxfont
Version : 1:2.0.4-1+deb11u1 1:2.0.6-1+deb12u1
CVE ID : CVE-2026-56001 CVE-2026-56002 CVE-2026-56003
A series of heap overflows in bitmap/PCF parser code could be used by
authenticated attackers to execute code in the X server context.
CVE-2026-56001
A heap buffer overflow in BitmapScaleBitmaps in due to an overflowing
32-bit size.
CVE-2026-56002
A heap bufferflow in pcfReadFont() due to missing glyph bounds
checking.
CVE-2026-56003
A heap buffer overflow due to missing size checking in the property
buffer when parsing PCF files in ComputeScaledProperties().
For Debian 11 bullseye, these problems have been fixed in version
1:2.0.4-1+deb11u1.
For Debian 12 bookworm, these problems have been fixed in version
1:2.0.6-1+deb12u1.
We recommend that you upgrade your libxfont packages.
For the detailed security status of libxfont please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libxfont
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCalPfQQAKCRDoRGtKyMdy
YRIzAP9nYo3gvCSX7xAYZCdI9/XfsugeGKGg+yrlFDf4EWZedgD/cFL3n8sVe+0y
8Jt8W2n05SiE2vQ8MtF58ZaJ09M4QwU=
=I1VF
-----END PGP SIGNATURE-----
