Your message dated Sat, 12 Sep 2026 16:17:19 +0000
with message-id <[email protected]>
and subject line Bug#1141703: fixed in xorg-server 2:21.1.16-1.3+deb13u4
has caused the Debian Bug report #1141703,
regarding xorg-server: CVE-2026-55999 CVE-2026-56000
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141703: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141703
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: xorg-server
Version: 2:21.1.23-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 2:21.1.16-1
Hi,
The following vulnerabilities were published for xorg-server.
CVE-2026-55999[0]:
| Local attackers with a X connection able to provide PCX fonts to the
| X server xorg-server before 21.2.24 and xwayland before 24.1.13
| could cause a heap buffer overflow via SetFont due to missing glyph
| boundary checks.
CVE-2026-56000[1]:
| Local attackers with a X connection able to provide GLX commit to
| the X server xorg-server before 21.2.24 and xwayland before 24.1.13
| could cause a Heap Use After Free, due to CommonMakeCurrent()
| pointing into potentially reallocated memory.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-55999
https://www.cve.org/CVERecord?id=CVE-2026-55999
[1] https://security-tracker.debian.org/tracker/CVE-2026-56000
https://www.cve.org/CVERecord?id=CVE-2026-56000
[2] https://www.openwall.com/lists/oss-security/2026/07/08/2
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: xorg-server
Source-Version: 2:21.1.16-1.3+deb13u4
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xorg-server, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated xorg-server
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 05 Sep 2026 07:52:43 +0200
Source: xorg-server
Architecture: source
Version: 2:21.1.16-1.3+deb13u4
Distribution: trixie-security
Urgency: high
Maintainer: Debian X Strike Force <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1141703
Changes:
xorg-server (2:21.1.16-1.3+deb13u4) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* GLX: Free the tag of the old context later
* glx: free old context tag before allocating new one in CommonMakeCurrent
(CVE-2026-56000) (Closes: #1141703)
* fb/mi/glamor: reject glyphs with negative dimensions
* glamor: reject fonts with per-glyph metrics exceeding maxbounds
(CVE-2026-55999) (Closes: #1141703)
Checksums-Sha1:
edd9fddd33e8c53a0b2f0b0fade80c08bff5de17 4236
xorg-server_21.1.16-1.3+deb13u4.dsc
fbfa24786a62f8aad0213e30d27e80d2aa2d1aaa 207997
xorg-server_21.1.16-1.3+deb13u4.diff.gz
8e48bb18c29683ab6c3c3fd6f3dc5e6feeaf0e3e 8515
xorg-server_21.1.16-1.3+deb13u4_source.buildinfo
Checksums-Sha256:
ef0e04fe6c415f94d8a90b5305974427825865e76ed61154005565be8602a2ef 4236
xorg-server_21.1.16-1.3+deb13u4.dsc
ad8b35823a0b82323ecdb3b3a6896d652106ed89ec927e49016c9eaefa35bf6b 207997
xorg-server_21.1.16-1.3+deb13u4.diff.gz
40b3d26325aacd5e506e362b72fe46f55240080bbfc9b9cdf208e1e780798946 8515
xorg-server_21.1.16-1.3+deb13u4_source.buildinfo
Files:
f47fc24e388514ca9b1ceff132210912 4236 x11 optional
xorg-server_21.1.16-1.3+deb13u4.dsc
33516ef2358203f46a646cef6b7de250 207997 x11 optional
xorg-server_21.1.16-1.3+deb13u4.diff.gz
03321089318456920fbb06602e4283bf 8515 x11 optional
xorg-server_21.1.16-1.3+deb13u4_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqfBvBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E2CIP+QEXtwDNr1zZjJvXL906nsbZ0DzkjW4Z
PItFGYMdj1Wf5BvjNzwt+dwu+anPj0AdHFD5/hJOcblqZoWK5I2IoN1cptJE5it1
muLnCy/IOHAMUIj69crdyRizeLwYXDrCnCQ4rCuJAQg5d/rjozcD4hF3c0nDw3AN
RLEFuAV/ik/4yfCeXNfA0Gf2WpOi4+ARj258VL7sFFmbRYGAKhIq8w4cLVMefeeP
GdatHzwA9Du9blBxB1+SCbOPDCGcCr5hGwzK+XicVA4Raa1EYGB20pihM3KmXgr5
saiLnRAkGX+O1Og2z+67i3kl8CmSv1BRK35QBluyOfLwwqjKUeLcb1oHfV4z8H6a
y2Fv2jz9Wbb9y8VDgKk0xSTia8VeOAtd4TnGaT5U/ASciCAFokM9KbbiBpQT55sh
1yhu6HT9p2eQ7RME3Ea6s835hvMsOENZb3zsxHSb7S4tfGzbdbXRzmjVJHHI2pg0
EFCDrBSnNKO5Xa4jqgBqawGW/LVAQRrpn/2QUBSjMuvqrKefOglQFviufVFd/4rJ
rpoqx6t73W9f6VEAkSch7sOknDFMetCaRO1dNqKDzs7iWvuqbeEAUrO58UYrVwS7
oXOb6WVJP0XJDxNStShHw6c4IdcZu7txvdduO19CG3nOrgVhEh3epEGdHp9CtCd7
Muq9+8WxA4H1
=IQtr
-----END PGP SIGNATURE-----
pgpRfLMZTHP4u.pgp
Description: PGP signature
--- End Message ---
