Your message dated Tue, 27 Oct 2026 07:49:28 +0000
with message-id <[email protected]>
and subject line Bug#1148735: fixed in libxrender 1:0.9.13-1
has caused the Debian Bug report #1148735,
regarding libxrender: CVE-2026-88807
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148735: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148735
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libxrender
Version: 1:0.9.12-1
Severity: important
Tags: security upstream
Forwarded:
https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libxrender.
CVE-2026-88807[0]:
| A heap overflow in libXrender before 0.9.13
| in RenderQueryPictFormats could be used by malicious X servers to
| inject code into attached X clients.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-88807
https://www.cve.org/CVERecord?id=CVE-2026-88807
[1] https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libxrender
Source-Version: 1:0.9.13-1
Done: Emilio Pozuelo Monfort <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libxrender, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emilio Pozuelo Monfort <[email protected]> (supplier of updated libxrender
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 26 Oct 2026 21:31:15 +0100
Source: libxrender
Architecture: source
Version: 1:0.9.13-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <[email protected]>
Changed-By: Emilio Pozuelo Monfort <[email protected]>
Closes: 1148735
Changes:
libxrender (1:0.9.13-1) unstable; urgency=medium
.
* New upstream release (closes: #1148735)
- CVE-2026-88807: OOB read in XRenderQueryFormat reply parser.
* Update signing-key.asc.
Checksums-Sha1:
fccd078263b222f330e57fce51fb70eceb0339c0 2002 libxrender_0.9.13-1.dsc
a208dfd9d169067b91c1b693c117944343e62848 460608 libxrender_0.9.13.orig.tar.gz
9b7fb2900549c5b5acd1bfa4a3e22bf2fde2632a 26505 libxrender_0.9.13-1.diff.gz
4b74400dbc7dcd6e1d5ae1da306e95189b7ab070 6348
libxrender_0.9.13-1_source.buildinfo
Checksums-Sha256:
d1e0fa2d03ac3402e449e73bdee3a75be391634ab3cb0e5a44dd69701b8fdf0a 2002
libxrender_0.9.13-1.dsc
bf264b683d1e49ff9a6bc03af13baa430a556d943731a2b1ac2439dae4fea205 460608
libxrender_0.9.13.orig.tar.gz
8272e0d966bb7c7c9d8d0a0dd70e9258bded5833ea675b2783d5c698d9b4eb8d 26505
libxrender_0.9.13-1.diff.gz
f62e2d60baeacf188d9116055e1aac610e418a3f50fb8cf810a87cdce61989db 6348
libxrender_0.9.13-1_source.buildinfo
Files:
bd3da4c1abfda13419b72e4bbbfd66b2 2002 x11 optional libxrender_0.9.13-1.dsc
1cce77b926b661582bb1a712ff3c86f3 460608 x11 optional
libxrender_0.9.13.orig.tar.gz
459bec407c6e105a9525d4e5b5f55f8b 26505 x11 optional libxrender_0.9.13-1.diff.gz
902c49169bc5b329defc4502051c488e 6348 x11 optional
libxrender_0.9.13-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmrgUkIACgkQnUbEiOQ2
gwJ/mRAAqKZDCXkoOk6DPbXaaYK4nZjHgaoPjXA5qM/MpeFG2aosHRIwpMjyBhc8
i9M/hLJrxkuvlii5DbuvIwiqeB1C+7UEBp912I/0aUnZSe8GgCDmb51s4G/s5YgW
kN/8ZEm+Pxgy+M+aK9xq5oe8QUI6zNBjUl001nxnPywWJCKKnT9rOwi7f8omh79k
AJTY8RzaNQQ6Fz+dtcTvXipVX882x2hnrzXMpThC/3uLtDVSHSZ0IxHYiCgTD5jd
WWCMyqeopke/8m3hBbCUb8VGbeyRb2bmTjyz2pN26mxAAMkqtjta3CxIhAdovbZy
ivOp8jj+Hcjswl4FiezWayaKo5bkYao6zAygSwwpPmcdSKijGIYTmAeUcON3CGOs
kMAUh8L2dzm2t12pmVbYzhosMxvB+uw89KaBwBI2iBfrQWoGnrBjYV9F18eQQyRf
lD/0Vl4qYadW+ilWMuO5+fFFLHPiSJaKwt6Yv1U7P4zvgbcGueQQvijasvLkbDgr
UKklSui2Q7l99helMDvqmT5okb4XEzzCIFWD8+85INzcfddD/c7ok1GH1242hO3g
itm37uOs4UmloBSlBNJXo7JXoF+4yz+jkywXlICKPrV1xzsz66AWbGLpkP363LJA
XZR41qb1xYqGmkHFwYR/jux6EKzzNZnJNyrWUdn6sp11c4CUg0Q=
=gTUy
-----END PGP SIGNATURE-----
pgpwSqPgHVJdr.pgp
Description: PGP signature
--- End Message ---
