AlmaLinux 9.6 [TuxCare] Security Update: libXfont2 / libXfont2-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787162017)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787162017 advisory. - fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks...

Rocky Linux 9.6 [TuxCare] Security Update: libXfont2 / libXfont2-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787162017)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787162017 advisory. - fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing check...

Rocky Linux 10.2 [CIQ] Security Update: libXfont2 / libXfont2-debuginfo / libXfont2-debugsource / etc Multiple Vulnerabilities (crlsa-2026_55448)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655448 advisory. libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in...

AlmaLinux 9.2 [TuxCare] Security Update: libXfont2 / libXfont2-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787150510)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787150510 advisory. - fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks...

AZL-101730 CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

AZL-101733 CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

UBUNTU-CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

UBUNTU-CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950

CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...

EUVD-2026-75306

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

EUVD-2026-75300

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...