Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *libxfont2* to *2.0.9* has Succeeded.
Next steps:
- apply the patch: git am 0001-libxfont2-upgrade-2.0.8-2.0.9.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From 83bc98b2fbd88b712a646d4124572300f35c677a Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Wed, 5 Aug 2026 05:09:07 +0000
Subject: [PATCH] libxfont2: upgrade 2.0.8 -> 2.0.9
Source: ChangeLog
commit 975cc6526e892c6fad8fa49d0fef58565fbaa003
Author: Peter Hutterer <[email protected]>
Date: Wed Aug 5 10:57:21 2026 +1000
libXfont2 2.0.9
Signed-off-by: Peter Hutterer <[email protected]>
commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a
Author: Peter Hutterer <[email protected]>
Date: Mon Jul 13 15:50:09 2026 +1000
fserve: bounds-check cumulative glyph data writes in fs_read_glyphs
fs_read_glyphs() copies each glyph's bitmap into a single allbits
buffer allocated to rep->nbytes bytes. The per-glyph guard validates
only that the source slice (position, length) lies within the pbitmaps
source buffer. It does not check whether the running destination cursor
has exceeded the allocation.
A malicious font server can send overlapping source offsets (e.g. 1000
glyphs each referencing {position:0, length:64} with nbytes=64). Each
individual source range passes validation, but the cumulative writes
total 64000 bytes into a 64-byte destination buffer.
Interestingly there was an unconditional debug printf in place that
sort-of warned about this but didn't prevent this. Let's remove that and
instead use the actual check to bail out before we run OOB.
A regression test is included that sends 100 glyphs each referencing
the same 64-byte source slice into a 64-byte destination buffer, and
verifies the library rejects the overflow.
CVE-2026-44950
Found-by: Zhixi "Jace" Sun, independent security researcher
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <[email protected]>
Part-of:
<https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
commit 668fea81f40bcb48ec67fb55d0b851049d265290
Author: Peter Hutterer <[email protected]>
Date: Mon Jul 13 15:48:06 2026 +1000
fserve: validate num_chars against encoding array size in fs_read_glyphs
FS_QueryXExtents16 causes us to allocate the encoding[] array, later
during the FS_QueryXBitmaps16 reply handling we fill in that array.
There is no verification that the allocation is large enough, a
malicious font server could send us a small numExtents and a
large num_chars to force underallocation and OOB read/rwrite.
A regression test is included that constructs a crafted
FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies
the library rejects it.
CVE-2026-59679
Found-by: Zhixi "Jace" Sun, independent security researcher
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <[email protected]>
Part-of:
<https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
commit 2d4b37f525df41399cf2cd409fb97aa30c48546a
Author: Peter Hutterer <[email protected]>
Date: Thu Jul 23 12:06:45 2026 +1000
Disable fontserver support by default
Debian has disabled this for over a dec
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
.../xorg-lib/{libxfont2_2.0.8.bb => libxfont2_2.0.9.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-graphics/xorg-lib/{libxfont2_2.0.8.bb =>
libxfont2_2.0.9.bb} (87%)
diff --git a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.8.bb
b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb
similarity index 87%
rename from meta/recipes-graphics/xorg-lib/libxfont2_2.0.8.bb
rename to meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb
index 33cf5816e0..82ca4d5024 100644
--- a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.8.bb
+++ b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb
@@ -15,7 +15,7 @@ XORG_PN = "libXfont2"
BBCLASSEXTEND = "native"
-SRC_URI[sha256sum] =
"f556c0e1093a4e6911cc90bc4b106d201902ee187fd74af206ff162f7e6a24d5"
+SRC_URI[sha256sum] =
"f042a370666815e7b941e9b7019024755bd1c6c2954afbfa515af378251799e2"
PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6,"
--
2.47.1
packages/x86-64-v3-poky-linux/libxfont2/libxfont2-dbg: PKGSIZE changed from 782296 to 607600 (-22%) packages/x86-64-v3-poky-linux/libxfont2/libxfont2-src: PKGSIZE changed from 793993 to 659714 (-17%) packages/x86-64-v3-poky-linux/libxfont2/libxfont2: PKGSIZE changed from 247218 to 193346 (-22%)
0001-libxfont2-upgrade-2.0.8-2.0.9.patch
Description: Binary data
packages/x86-64-v3-poky-linux/libxfont2: SRC_URI changed from "https://www.x.org/releases//individual/lib/libXfont2-2.0.8.tar.xz"; to "https://www.x.org/releases//individual/lib/libXfont2-2.0.9.tar.xz"; packages/x86-64-v3-poky-linux/libxfont2: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-dbg: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2-dbg: PKGSIZE changed from 782296 to 607600 (-22%) packages/x86-64-v3-poky-linux/libxfont2/libxfont2-dbg: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-dev: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2-dev: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-doc: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2-doc: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-locale: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2-locale: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-src: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2-src: PKGSIZE changed from 793993 to 659714 (-17%) packages/x86-64-v3-poky-linux/libxfont2/libxfont2-src: FILELIST: directory renamed /usr/src/debug/libxfont2/2.0.8/src/bitmap -> /usr/src/debug/libxfont2/2.0.9/src/bitmap, directory renamed /usr/src/debug/libxfont2/2.0.8/src/util -> /usr/src/debug/libxfont2/2.0.9/src/util, directory renamed /usr/src/debug/libxfont2/2.0.8/src/fontfile -> /usr/src/debug/libxfont2/2.0.9/src/fontfile, directory renamed /usr/src/debug/libxfont2/2.0.8/include -> /usr/src/debug/libxfont2/2.0.9/include, directory renamed /usr/src/debug/libxfont2/2.0.8/include/X11/fonts -> /usr/src/debug/libxfont2/2.0.9/include/X11/fonts, directory renamed /usr/src/debug/libxfont2/2.0.8/src/FreeType -> /usr/src/debug/libxfont2/2.0.9/src/FreeType, directory renamed /usr/src/debug/libxfont2/2.0.8/src/builtins -> /usr/src/debug/libxfont2/2.0.9/src/builtins, directory renamed /usr/src/debug/libxfont2/2.0.8/src/stubs -> /usr/src/debug/libxfont2/2.0.9/src/stubs, removed all items "/usr/src/debug/libxfont2/2.0.8/src/fc/fservestr.h /u sr/src/debug/libxfont2/2.0.8/src/fc/fsio.h /usr/src/debug/libxfont2/2.0.8/src/fc/fserve.c /usr/src/debug/libxfont2/2.0.8/src/fc/fsio.c /usr/src/debug/libxfont2/2.0.8/src/fc/fsconvert.c /usr/src/debug/libxfont2/2.0.8/src/fc/fserve.h" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-src: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2-staticdev: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2-staticdev: PV changed from "2.0.8" to "2.0.9" packages/x86-64-v3-poky-linux/libxfont2/libxfont2: PKGV changed from 2.0.8 [default] to 2.0.9 [default] packages/x86-64-v3-poky-linux/libxfont2/libxfont2: PKGSIZE changed from 247218 to 193346 (-22%) packages/x86-64-v3-poky-linux/libxfont2/libxfont2: PV changed from "2.0.8" to "2.0.9"
Changelog for libxfont2: 2.0.8 -> 2.0.9 Source: ChangeLog commit 975cc6526e892c6fad8fa49d0fef58565fbaa003 Author: Peter Hutterer <[email protected]> Date: Wed Aug 5 10:57:21 2026 +1000 libXfont2 2.0.9 Signed-off-by: Peter Hutterer <[email protected]> commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a Author: Peter Hutterer <[email protected]> Date: Mon Jul 13 15:50:09 2026 +1000 fserve: bounds-check cumulative glyph data writes in fs_read_glyphs fs_read_glyphs() copies each glyph's bitmap into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph guard validates only that the source slice (position, length) lies within the pbitmaps source buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64). Each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. Interestingly there was an unconditional debug printf in place that sort-of warned about this but didn't prevent this. Let's remove that and instead use the actual check to bail out before we run OOB. A regression test is included that sends 100 glyphs each referencing the same 64-byte source slice into a 64-byte destination buffer, and verifies the library rejects the overflow. CVE-2026-44950 Found-by: Zhixi "Jace" Sun, independent security researcher Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Peter Hutterer <[email protected]> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36> commit 668fea81f40bcb48ec67fb55d0b851049d265290 Author: Peter Hutterer <[email protected]> Date: Mon Jul 13 15:48:06 2026 +1000 fserve: validate num_chars against encoding array size in fs_read_glyphs FS_QueryXExtents16 causes us to allocate the encoding[] array, later during the FS_QueryXBitmaps16 reply handling we fill in that array. There is no verification that the allocation is large enough, a malicious font server could send us a small numExtents and a large num_chars to force underallocation and OOB read/rwrite. A regression test is included that constructs a crafted FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies the library rejects it. CVE-2026-59679 Found-by: Zhixi "Jace" Sun, independent security researcher Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Peter Hutterer <[email protected]> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36> commit 2d4b37f525df41399cf2cd409fb97aa30c48546a Author: Peter Hutterer <[email protected]> Date: Thu Jul 23 12:06:45 2026 +1000 Disable fontserver support by default Debian has disabled this for over a decade by default and it removes another source of untrusted data that few, if any, users rely on anymore. Signed-off-by: Peter Hutterer <[email protected]> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/35> commit c2fc759bbb6d2829ac10a145f0f9bc01a47d6eed Author: Peter Hutterer <[email protected]> Date: Thu Jul 23 12:28:19 2026 +1000 README: fix documentation for --enable-snfformat Disabled by default in 2014 in commit 37595cfd4fea ("Change default to disabling SNF support") Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/35>
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242813): https://lists.openembedded.org/g/openembedded-core/message/242813 Mute This Topic: https://lists.openembedded.org/mt/120606452/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
