CentOS Linux 7 [TuxCare] Security Update: libXfont2 / libXfont2-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787393547)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787393547 advisory. - A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers abl...

Oracle Linux 7 : ELSA-2026-62231-0: / libXfont2 (ELSA-2026-622310)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-622310 advisory. - Backport fix for CVE-2026-44950 Orabug: 39960840 - Backport fix for CVE-2026-59679 Orabug: 39960840 Tenable has extracted the preceding description...

libXfont2 security update

2.0.3-1.0.3 - Backport fix for CVE-2026-44950 Orabug: 39960840 - Backport fix for CVE-2026-59679 Orabug: 39960840 2.0.3-1.0.1 - Fix CVE-2026-56001, CVE-2026-56002, and CVE-2026-56003 Orabug: 39843361...

CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1

CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1

CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1. An upgraded version of the package is available that resolves this issue...

EulerOS 2.0 SP10 : libXfont2 (EulerOS-SA-2026-3698)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before...

EulerOS 2.0 SP10 : libXfont2 (EulerOS-SA-2026-3746)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. A mismatch between the X server’s requirements and the maximum font name length supported by the libXfont2 library can lead to a stack buffer overflow during font alias resolution. The X server allocate...

AZL-101730 CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

AZL-101733 CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950

CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...

EUVD-2026-75306

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

EUVD-2026-75300

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...