This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-April/003690.html
* CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
Olivier Fourdan (2):
Fix CVE-2026-4367: Out-of-bounds read in xpmNextWord()
libXpm 3.5.19
git tag: libXpm-3.5.19
https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.19.tar.gz
SHA256: f241f705c607fba1a53338f7e1c12005d6da326b5cb55a11a10847781b4578c0
libXpm-3.5.19.tar.gz
SHA512:
7920e93cc72a162fe019e722240ffa131aec3dc2d4388f34e0c6aa5c01634efec8153e60f6fd8be3552275d6910db5154577824f82a90aa1de8de6c224efe104
libXpm-3.5.19.tar.gz
PGP:
https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.19.tar.gz.sig
https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.19.tar.xz
SHA256: ad3576d689221a39dc728f0e0dc02ca7bb6a0d724c9a77fd1bfa1e9af83be900
libXpm-3.5.19.tar.xz
SHA512:
dd95a70af0ac2fb0f5876e69ad19b38128c5add94b00238ee41a22634aa4dc56b22c1b47c4baa6a1ab549308d11b302c250b405322da8a64ea24441a065fbada
libXpm-3.5.19.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/lib/libXpm-3.5.19.tar.xz.sig
OpenPGP_0x14706DBE1E4B4540.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
