[Midnightbsd-cvs] [MidnightBSD/mports] ea98bc: x11-fonts/libXfont2: update to 2.0.9 to fix two fo...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: ea98bc365de932a38d73de1c48562ada527b4f72
      https://github.com/MidnightBSD/mports/commit/ea98bc365de932a38d73de1c48562ada527b4f72
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-04 (Tue, 04 Aug 2026)

  Changed paths:
    M x11-fonts/libXfont2/Makefile
    M x11-fonts/libXfont2/distinfo

  Log Message:
  -----------
  x11-fonts/libXfont2: update to 2.0.9 to fix two font-server vulnerabilities (#686)

Updates `x11-fonts/libXfont2` 2.0.8 → 2.0.9, released 2026-08-05.

## Vulnerabilities fixed

Both are in the font-server client code and reachable from a malicious
or compromised font server:

**CVE-2026-44950** — `fs_read_glyphs()` copies each glyph's bitmap into
a single `allbits` buffer sized to `rep->nbytes`. The per-glyph guard
only validated that the *source* slice lay within the source buffer, not
that the running *destination* cursor stayed within the allocation.
Overlapping source offsets (e.g. 1000 glyphs each referencing
`{position:0, length:64}` with `nbytes=64`) each pass validation
individually while cumulatively writing 64000 bytes into a 64-byte
buffer.

**CVE-2026-59679** — the `encoding[]` array is allocated while handling
`FS_QueryXExtents16` and filled while handling `FS_QueryXBitmaps16`,
with no check that the allocation was large enough. A small `numExtents`
with a large `num_chars` forces an underallocation and an out-of-bounds
read/write.

Both were found by Zhixi "Jace" Sun and carry regression tests upstream.

## Note on the June 2026 advisory

The three CVEs from the [June 2026 X.Org
advisory](https://www.openwall.com/lists/oss-security/2026/06/02/1) —
CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 — were already fixed in
**2.0.8**, which this port was on. The two above are new in 2.0.9 and
are not covered by that advisory.

## Impact on dependents

The shared library version is unchanged at `libXfont2.so.2.0.0`, so no
dependent ports need a `PORTREVISION` bump.

## Validation

Builds and packages cleanly; `pkg-plist` unchanged. The distfile
checksum was cross-checked against an independent download from x.org:

```
f042a370666815e7b941e9b7019024755bd1c6c2954afbfa515af378251799e2
```

portlint reports 0 fatal errors. Its two warnings about the `WWW:` line
in `pkg-descr` are pre-existing and unrelated; left alone to keep this
change reviewable as a security fix.

## Follow-up worth considering

`security/vuxml` has no entry for libXfont2 — not for these two CVEs,
nor for the three fixed in 2.0.8. Without one, `mport audit` will not
warn anyone still running a vulnerable version. Happy to add those
entries as a separate PR.

Sources: [X.Org release](https://www.x.org/releases/individual/lib/),
upstream `ChangeLog` in the 2.0.9 tarball.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Update x11-fonts/libXfont2 to version 2.0.9 to incorporate upstream
security fixes for the font-server client.

Bug Fixes:
- Pull in upstream fixes for two font-server client vulnerabilities
affecting glyph bitmap handling and encoding array bounds checking.

Build:
- Refresh distinfo to match the 2.0.9 release tarball.

Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications