Backport upstream commit 668fea81 to fix CVE-2026-59679, an
out-of-bounds read/write vulnerability in fs_read_glyphs().
The fix validates that num_chars from the FS_QueryXBitmaps16
reply does not exceed the encoding array size allocated during
FS_QueryXExtents16 handling, preventing exploitation by a
malicious font server. A regression test is included.
CVE: CVE-2026-59679
Upstream patches:
- 668fea81f4.patch
Resolves: RHEL-221956
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-44950 to libXfont2 2.0.3.
The fix adds a bounds-check for cumulative glyph data writes
in fs_read_glyphs() to prevent heap overflow from overlapping
source offsets sent by a malicious font server. A new regression
test (test-fserve-read-glyphs.c) is included to verify the fix.
CVE: CVE-2026-44950
Upstream patches:
- c2d222bb22.patch
Resolves: RHEL-222015
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
