-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 05 Sep 2026 07:52:43 +0200 Source: xorg-server Architecture: source Version: 2:21.1.16-1.3+deb13u4 Distribution: trixie-security Urgency: high Maintainer: Debian X Strike Force <debian-x@lists.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1141703 Changes: xorg-server (2:21.1.16-1.3+deb13u4) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * GLX: Free the tag of the old context later * glx: free old context tag before allocating new one in CommonMakeCurrent (CVE-2026-56000) (Closes: #1141703) * fb/mi/glamor: reject glyphs with negative dimensions * glamor: reject fonts with per-glyph metrics exceeding maxbounds (CVE-2026-55999) (Closes: #1141703) Checksums-Sha1: edd9fddd33e8c53a0b2f0b0fade80c08bff5de17 4236 xorg-server_21.1.16-1.3+deb13u4.dsc fbfa24786a62f8aad0213e30d27e80d2aa2d1aaa 207997 xorg-server_21.1.16-1.3+deb13u4.diff.gz 8e48bb18c29683ab6c3c3fd6f3dc5e6feeaf0e3e 8515 xorg-server_21.1.16-1.3+deb13u4_source.buildinfo Checksums-Sha256: ef0e04fe6c415f94d8a90b5305974427825865e76ed61154005565be8602a2ef 4236 xorg-server_21.1.16-1.3+deb13u4.dsc ad8b35823a0b82323ecdb3b3a6896d652106ed89ec927e49016c9eaefa35bf6b 207997 xorg-server_21.1.16-1.3+deb13u4.diff.gz 40b3d26325aacd5e506e362b72fe46f55240080bbfc9b9cdf208e1e780798946 8515 xorg-server_21.1.16-1.3+deb13u4_source.buildinfo Files: f47fc24e388514ca9b1ceff132210912 4236 x11 optional xorg-server_21.1.16-1.3+deb13u4.dsc 33516ef2358203f46a646cef6b7de250 207997 x11 optional xorg-server_21.1.16-1.3+deb13u4.diff.gz 03321089318456920fbb06602e4283bf 8515 x11 optional xorg-server_21.1.16-1.3+deb13u4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqfBvBfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E2CIP+QEXtwDNr1zZjJvXL906nsbZ0DzkjW4Z PItFGYMdj1Wf5BvjNzwt+dwu+anPj0AdHFD5/hJOcblqZoWK5I2IoN1cptJE5it1 muLnCy/IOHAMUIj69crdyRizeLwYXDrCnCQ4rCuJAQg5d/rjozcD4hF3c0nDw3AN RLEFuAV/ik/4yfCeXNfA0Gf2WpOi4+ARj258VL7sFFmbRYGAKhIq8w4cLVMefeeP GdatHzwA9Du9blBxB1+SCbOPDCGcCr5hGwzK+XicVA4Raa1EYGB20pihM3KmXgr5 saiLnRAkGX+O1Og2z+67i3kl8CmSv1BRK35QBluyOfLwwqjKUeLcb1oHfV4z8H6a y2Fv2jz9Wbb9y8VDgKk0xSTia8VeOAtd4TnGaT5U/ASciCAFokM9KbbiBpQT55sh 1yhu6HT9p2eQ7RME3Ea6s835hvMsOENZb3zsxHSb7S4tfGzbdbXRzmjVJHHI2pg0 EFCDrBSnNKO5Xa4jqgBqawGW/LVAQRrpn/2QUBSjMuvqrKefOglQFviufVFd/4rJ rpoqx6t73W9f6VEAkSch7sOknDFMetCaRO1dNqKDzs7iWvuqbeEAUrO58UYrVwS7 oXOb6WVJP0XJDxNStShHw6c4IdcZu7txvdduO19CG3nOrgVhEh3epEGdHp9CtCd7 Muq9+8WxA4H1 =IQtr -----END PGP SIGNATURE-----
