This release contains the fixes for the issues reported in today's security advisory:
https://lists.x.org/archives/xorg-announce/2026-July/003714.html - CVE-2026-56001: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow - CVE-2026-56002: PCF Font Parsing Heap Buffer Overflow - CVE-2026-56003: computeProps Property Buffer Heap Buffer Overflow Additionally it contains a number of minor cleanup patches and the removal of a decades-obsolete compat API. Adam Jackson (3): freetype: Fix encoding string assembly freetype: Remove misguided ifdef around BDF charset query fontfile: Remove ridiculously old compat API Alan Coopersmith (2): gitlab CI: drop the ci-fairy check-mr job gitlab CI: move back to Debian stable image Peter Hutterer (12): pcfread: fix strings memory leak in pcfGetProperties error path bdfread: fix copy-paste error in RESOLUTION_X/Y property generation bdfread: fix BDF_GENPROPS undercount causing heap buffer overflow fsio: fix unchecked realloc render: use calloc for FontRec to prevent use of uninitialized memory freetype: Remove premature break in find_cmap() Unicode fallback bitscale: fix integer overflow in BitmapScaleBitmaps bytestoalloc pcfread: validate bitmap sizes and offsets against per-glyph metrics bitscale: add bounds check to computeProps for property buffer test: fix stubs in font-test-utils for use outside the X server test: add PCF security regression tests libXfont2 2.0.8 git tag: libXfont2-2.0.8 https://xorg.freedesktop.org/archive/individual/lib/libXfont2-2.0.8.tar.gz SHA256: a53d621b6ceb1dcbd05a0b9bd7f13c34efa40401cd5c05af904035c567a30f18 libXfont2-2.0.8.tar.gz SHA512: c3e23713b1ebd209773703987465d6173fd14964f8d0c1bbfe2ff76ae41825e0afe76ad0d707b89da056ffe07124de9e6bdf8a37e3ca15b5195bb9b7e08275fe libXfont2-2.0.8.tar.gz PGP: https://xorg.freedesktop.org/archive/individual/lib/libXfont2-2.0.8.tar.gz.sig https://xorg.freedesktop.org/archive/individual/lib/libXfont2-2.0.8.tar.xz SHA256: f556c0e1093a4e6911cc90bc4b106d201902ee187fd74af206ff162f7e6a24d5 libXfont2-2.0.8.tar.xz SHA512: e14cc3fa03d7baa4554ee5754ab33f69ac1da3d509c686a5f705fde8cd07772be564d68cc18d9fd0beb5ed7b2f864fcd7f6bf4983f5c0db08a9c747d0e001531 libXfont2-2.0.8.tar.xz PGP: https://xorg.freedesktop.org/archive/individual/lib/libXfont2-2.0.8.tar.xz.sig
signature.asc
Description: PGP signature
