Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux libXfont2 may crash or be hijacked
published 3 months ago
Summary
The libXfont2 library used in AlmaLinux (including the development package) contains a buffer overflow in its property‑handling code. This flaw could let an attacker cause the program to stop working or potentially run their own code. Install the latest libXfont2 updates from AlmaLinux to fix the issue.
What to do
- Update almalinux libxfont2 to version 2.0.3-12.el9.tuxcare.els3.
- Update almalinux libxfont2-devel to version 2.0.3-12.el9.tuxcare.els3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | libxfont2 |
< 2.0.3-12.el9.tuxcare.els3 Fix: upgrade to 2.0.3-12.el9.tuxcare.els3
|
| TuxCare:AlmaLinux:9.2 | almalinux | libxfont2-devel |
< 2.0.3-12.el9.tuxcare.els3 Fix: upgrade to 2.0.3-12.el9.tuxcare.els3
|
Original advisory text
libXfont2: Fix of 3 CVEs
- Fix CVE-2026-56003: property buffer overflow in computeProps /
ComputeScaledProperties in bitscale.c
(upstream commit dff957a5158da038a282a59a31fe736702732939)
ComputeScaledProperties in bitscale.c
(upstream commit dff957a5158da038a282a59a31fe736702732939)
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784797098.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56001 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56002 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56003 Vendor Advisory
Timeline
Published23 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784797098 · OSV
Track software like this
Free during beta