Your message dated Wed, 11 Nov 2026 03:34:15 +0000
with message-id <[email protected]>
and subject line Bug#1153675: fixed in xorg-server 2:21.1.26-1
has caused the Debian Bug report #1153675,
regarding xorg-server: CVE-2026-109091 CVE-2026-109092 CVE-2026-109093
CVE-2026-109904 CVE-2026-109094 CVE-2026-109095 CVE-2026-109096 CVE-2026-109903
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1153675: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1153675
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: xorg-server
Version: 2:21.1.25-2
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream
Hi,
The following vulnerabilities were published for xorg-server.
CVE-2026-109091[0]:
| X.Org Server EDID DS_RANGES Out-Of-Bounds Write
CVE-2026-109092[1]:
| X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
CVE-2026-109093[2]:
| X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
CVE-2026-109904[3]:
| X.Org Server XRes QueryClientIds Request Size Overflow
CVE-2026-109094[4]:
| X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
CVE-2026-109095[5]:
| X.Org Server glamor Xv Image Size Integer Overflow
CVE-2026-109096[6]:
| X.Org Server XvPutImage Negative Image Size Length Bypass
CVE-2026-109903[7]:
| X.Org Server XvQueryImageAttributes Negative Size Reply
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-109091
https://www.cve.org/CVERecord?id=CVE-2026-109091
[1] https://security-tracker.debian.org/tracker/CVE-2026-109092
https://www.cve.org/CVERecord?id=CVE-2026-109092
[2] https://security-tracker.debian.org/tracker/CVE-2026-109093
https://www.cve.org/CVERecord?id=CVE-2026-109093
[3] https://security-tracker.debian.org/tracker/CVE-2026-109904
https://www.cve.org/CVERecord?id=CVE-2026-109904
[4] https://security-tracker.debian.org/tracker/CVE-2026-109094
https://www.cve.org/CVERecord?id=CVE-2026-109094
[5] https://security-tracker.debian.org/tracker/CVE-2026-109095
https://www.cve.org/CVERecord?id=CVE-2026-109095
[6] https://security-tracker.debian.org/tracker/CVE-2026-109096
https://www.cve.org/CVERecord?id=CVE-2026-109096
[7] https://security-tracker.debian.org/tracker/CVE-2026-109903
https://www.cve.org/CVERecord?id=CVE-2026-109903
[8] https://lists.x.org/archives/xorg-announce/2026-November/003759.html
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: xorg-server
Source-Version: 2:21.1.26-1
Done: Timo Aaltonen <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xorg-server, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Timo Aaltonen <[email protected]> (supplier of updated xorg-server package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 11 Nov 2026 05:09:36 +0200
Source: xorg-server
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2:21.1.26-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <[email protected]>
Changed-By: Timo Aaltonen <[email protected]>
Closes: 1153675
Changes:
xorg-server (2:21.1.26-1) unstable; urgency=medium
.
* Team upload.
* New upstream release. (Closes: #1153675)
- CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write
- CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
- CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack
Out-Of-Bounds Write
- CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow
- CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size
Overflow
- CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow
- CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length
Bypass
- CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply
* patches: Drop upstreamed patch.
Checksums-Sha1:
879141d8408c39b052896d20a79a777334f29e7f 4252 xorg-server_21.1.26-1.dsc
5dfd258ac9992eccfd545f8f3d0dac2eee275729 9062387
xorg-server_21.1.26.orig.tar.gz
f8c735f9c069ffaee0e7a2644c4a0e2c5964d9a9 195
xorg-server_21.1.26.orig.tar.gz.asc
c9fec6726b7c26ee1281da4936ecc4f9ab63cdd7 175085 xorg-server_21.1.26-1.diff.gz
2aa235128be7b281abffa751392106f483d2ed82 11903
xorg-server_21.1.26-1_source.buildinfo
Checksums-Sha256:
fae1156aed9a84cc0cde6fed5155918c90e687e2a2dc707f86b96998414f3e79 4252
xorg-server_21.1.26-1.dsc
023f05307350a3645084353c81bfb62fe9b9afe2b5e885cabc0892ae87de1f31 9062387
xorg-server_21.1.26.orig.tar.gz
3d82e55f28a83e4c86d6696149f928ea8b4296e421e2d4f040ca9f97c377e9ad 195
xorg-server_21.1.26.orig.tar.gz.asc
5ce9b11d031022e4a0818bfa171775f3f341f31ab9b0559f7762e4b3de4481b8 175085
xorg-server_21.1.26-1.diff.gz
43bd187e2f817d1df70b3b74fa8ac7c2ad7cde2eb7b0a264c04176e90a8a9eaf 11903
xorg-server_21.1.26-1_source.buildinfo
Files:
aac399847c3a685b4618e8c0550040fe 4252 x11 optional xorg-server_21.1.26-1.dsc
a88663960a964a2df9f543eff410ac83 9062387 x11 optional
xorg-server_21.1.26.orig.tar.gz
3e5765ae0871a11166e2fdb446abb320 195 x11 optional
xorg-server_21.1.26.orig.tar.gz.asc
06c6be967ddbe78fc6020e5700c4c8ac 175085 x11 optional
xorg-server_21.1.26-1.diff.gz
1d9f461c6600a4646dab434ec10fe762 11903 x11 optional
xorg-server_21.1.26-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEdS3ifE3rFwGbS2Yjy3AxZaiJhNwFAmrz3PUACgkQy3AxZaiJ
hNxolxAApPsN8YPE7j5KqJoEu5Q9aimwoIfz0HyRJy3T3aTUdeTTm3T0p4njbXEM
x2oyt63d2ejp65kLnv6RhtOjNlwA+A6Clt4IT0h1UEiWUleu4ZhNJn5BrWq0w/xj
ek5EVPRFJ10VI03jFGF3h67gVtGOJsOVdN6dQtt/kFsqCUdjTIBh5P28z8wFaabS
7CunJSKLoZ8Pkpq0N8NgvqePLE3nvR1X5Q8Hngd8Ge2fTL78K74t1soX5WqFV9Xz
ol3IndxepuTbVou6T/IrF5MrKc2rDX1pCQlJaLMEZQWJ1WciCsJ7HwtssyWuElWF
zPZ76dbK6m5g+BmQtDcx4+rsrn14rTSZ9Jy4dBSNx0366/MRkUs4tuO6BlEGb+F4
IirIUgty54xCsg4x8M1V9wvdItfHs67M50tv8QggSaowVE73zUUilZXHjGqXapwC
Obi+HGjyMyZAej8B0o0E1KVxWaRKsyMmrDGTudrjMSYVTGkFlgHCWCdWe39OmkgI
+yvGl4i+2wR6zMU29V5YwbH2QF42EoHMXN0r8y9BA++k5QJKdQDTuFf7vq+1eMiz
VM70IZc3bSj5iepr4pzcwcrMh7npsCYRjlEF/RRDxzIIHKZppF2EwxvWt6muNm3w
KELDnvmQOmv7fBAxQKxM8JYeO/n38uzI/yPqfBBQW3KIDBfjqLQ=
=w04q
-----END PGP SIGNATURE-----
pgpMqRlmKv4pv.pgp
Description: PGP signature
--- End Message ---
