From patchwork Wed Aug 5 05:47:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 94559 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FB74C561E6 for ; Wed, 5 Aug 2026 05:47:41 +0000 (UTC) Received: from a27-45.smtp-out.us-west-2.amazonses.com (a27-45.smtp-out.us-west-2.amazonses.com [54.240.27.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.34095.1785908851605754606 for ; Tue, 04 Aug 2026 22:47:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=Hn8EBs6w; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=PiB/4keW; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.45, mailfrom: 0101019fd0766ded-e86f93f1-b35f-4399-a858-7f23240342aa-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1785908850; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date; bh=GyKZQb/Ia9oqmxFeI6dJm3wgPavGuulxxMl0NbPyycw=; b=Hn8EBs6wtwdI2HBNRNMg+lmioIzGYy/r8L6yfDoo3DIvy4C1jU+DCJo0pxbR8swU 0fsmcer4U8md4y6ziTpD0OE3dLfhqakmu1MK0nfWn/NCiN3TvifKuFkCO07KcPcsYET hmE8m0ui5zuY9iVo+5b0weqygvsuXunB7RTsBK1E= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1785908850; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date:Feedback-ID; bh=GyKZQb/Ia9oqmxFeI6dJm3wgPavGuulxxMl0NbPyycw=; b=PiB/4keW1bw+930FltZugJgY66bUQrwfurMU8bp5MdB4uEQX+RIWBVGulcyxhL6w MkIo6y9F2/4qYfY+tUNTQ2sZtjT6KSvzpTtuKxMDlfxOZVxvkJLtsa/vWE6CrMAtj7R gvRsaLZADy/xntQZFYlrwdWtTH2p+LjwJaNjnUoM= MIME-Version: 1.0 From: auh@yoctoproject.org To: openembedded-core@lists.openembedded.org Subject: [AUH] libxfont2: upgrading to 2.0.9 SUCCEEDED Message-ID: <0101019fd0766ded-e86f93f1-b35f-4399-a858-7f23240342aa-000000@us-west-2.amazonses.com> Date: Wed, 5 Aug 2026 05:47:30 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.08.05-54.240.27.45 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 05 Aug 2026 05:47:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242813 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *libxfont2* to *2.0.9* has Succeeded. Next steps: - apply the patch: git am 0001-libxfont2-upgrade-2.0.8-2.0.9.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 83bc98b2fbd88b712a646d4124572300f35c677a Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Wed, 5 Aug 2026 05:09:07 +0000 Subject: [PATCH] libxfont2: upgrade 2.0.8 -> 2.0.9 Source: ChangeLog commit 975cc6526e892c6fad8fa49d0fef58565fbaa003 Author: Peter Hutterer Date: Wed Aug 5 10:57:21 2026 +1000 libXfont2 2.0.9 Signed-off-by: Peter Hutterer commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a Author: Peter Hutterer Date: Mon Jul 13 15:50:09 2026 +1000 fserve: bounds-check cumulative glyph data writes in fs_read_glyphs fs_read_glyphs() copies each glyph's bitmap into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph guard validates only that the source slice (position, length) lies within the pbitmaps source buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64). Each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. Interestingly there was an unconditional debug printf in place that sort-of warned about this but didn't prevent this. Let's remove that and instead use the actual check to bail out before we run OOB. A regression test is included that sends 100 glyphs each referencing the same 64-byte source slice into a 64-byte destination buffer, and verifies the library rejects the overflow. CVE-2026-44950 Found-by: Zhixi "Jace" Sun, independent security researcher Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Peter Hutterer Part-of: commit 668fea81f40bcb48ec67fb55d0b851049d265290 Author: Peter Hutterer Date: Mon Jul 13 15:48:06 2026 +1000 fserve: validate num_chars against encoding array size in fs_read_glyphs FS_QueryXExtents16 causes us to allocate the encoding[] array, later during the FS_QueryXBitmaps16 reply handling we fill in that array. There is no verification that the allocation is large enough, a malicious font server could send us a small numExtents and a large num_chars to force underallocation and OOB read/rwrite. A regression test is included that constructs a crafted FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies the library rejects it. CVE-2026-59679 Found-by: Zhixi "Jace" Sun, independent security researcher Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Peter Hutterer Part-of: commit 2d4b37f525df41399cf2cd409fb97aa30c48546a Author: Peter Hutterer Date: Thu Jul 23 12:06:45 2026 +1000 Disable fontserver support by default Debian has disabled this for over a dec [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../xorg-lib/{libxfont2_2.0.8.bb => libxfont2_2.0.9.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-graphics/xorg-lib/{libxfont2_2.0.8.bb => libxfont2_2.0.9.bb} (87%) diff --git a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.8.bb b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb similarity index 87% rename from meta/recipes-graphics/xorg-lib/libxfont2_2.0.8.bb rename to meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb index 33cf5816e0..82ca4d5024 100644 --- a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.8.bb +++ b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb @@ -15,7 +15,7 @@ XORG_PN = "libXfont2" BBCLASSEXTEND = "native" -SRC_URI[sha256sum] = "f556c0e1093a4e6911cc90bc4b106d201902ee187fd74af206ff162f7e6a24d5" +SRC_URI[sha256sum] = "f042a370666815e7b941e9b7019024755bd1c6c2954afbfa515af378251799e2" PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6,"