[Midnightbsd-cvs] [MidnightBSD/mports] f36175: x11-fonts/libXfont2: update to 2.0.9 to fix two fo...

[Lucas Holt]

  Branch: refs/heads/x11-fonts/libXfont2
  Home:   https://github.com/MidnightBSD/mports
  Commit: f36175142dead4f8ade630875f8858c303f8a1d6
      https://github.com/MidnightBSD/mports/commit/f36175142dead4f8ade630875f8858c303f8a1d6
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-04 (Tue, 04 Aug 2026)

  Changed paths:
    M x11-fonts/libXfont2/Makefile
    M x11-fonts/libXfont2/distinfo

  Log Message:
  -----------
  x11-fonts/libXfont2: update to 2.0.9 to fix two font-server vulnerabilities

libXfont2 2.0.9 fixes two issues in the font server client code, both
reachable from a malicious or compromised font server:

- CVE-2026-44950: fs_read_glyphs() copies each glyph's bitmap into a single
  allbits buffer sized to rep->nbytes. The per-glyph guard only validated that
  the source slice lay within the source buffer, not that the running
  destination cursor stayed within the allocation, so overlapping source
  offsets could accumulate far past the end of it.

- CVE-2026-59679: the encoding[] array is allocated while handling
  FS_QueryXExtents16 and filled in while handling FS_QueryXBitmaps16, with no
  check that the allocation was large enough. A small numExtents combined with
  a large num_chars forced an underallocation and an out-of-bounds read/write.

Both were found by Zhixi "Jace" Sun and carry regression tests upstream.

The three CVEs from the June 2026 X.Org advisory (CVE-2026-56001, -56002 and
-56003) were already fixed in 2.0.8, which the port was on; these two are new
in 2.0.9.

The shared library version is unchanged at libXfont2.so.2.0.0, so no dependent
ports need a PORTREVISION bump.

Verified: builds and packages; the distfile checksum was cross-checked against
an independent download from x.org.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications