ECHO-3C27-FC81-AC46 Heap overflow in fs_read_glyphs() in the font-server client (src/fc/fserve.c). Debian builds libXfont2 with --disable-fc (debian/rules), so the font-server client is not compiled: the shipped libXfont2.so.2.0.0 (1:2.0.6-1+deb13u1) contains no fs_read_glyphs or other fserve code. Debian rates it unimportant ("Disabled support to connect to font server since 1:1.4.7-1").

Bulletin has no description...