EulerOS 2.0 SP10 : libXfont2 (EulerOS-SA-2026-3698)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before...

EulerOS 2.0 SP10 : libXfont2 (EulerOS-SA-2026-3746)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. A mismatch between the X server’s requirements and the maximum font name length supported by the libXfont2 library can lead to a stack buffer overflow during font alias resolution. The X server allocate...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

AZL-101730 CVE-2026-59679 affecting package libXfont2 2.0.8-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

AZL-101733 CVE-2026-44950 affecting package libXfont2 2.0.8-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

EUVD-2026-75306

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950

CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...

CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

EUVD-2026-75300

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

EulerOS 2.0 SP12 : libXfont2 (EulerOS-SA-2026-3272)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client...

EulerOS 2.0 SP12 : libXfont2 (EulerOS-SA-2026-3347)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client...

RHSA-2026:62231 Red Hat Security Advisory: libXfont2 security update

Bulletin has no description...

RHSA-2026:62123 Red Hat Security Advisory: libXfont2 security update

Bulletin has no description...

RHSA-2026:61995 Red Hat Security Advisory: libXfont2 security update

Bulletin has no description...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write

A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privile...