Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56003: computeProps Property Buffer Heap Buffer Overflow CVE-2026-56002: PCF Font Parsing Heap Buffer Overflow CVE-2026-56001: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libXfont | 0:1.5.4-1.amzn2.0.1 |
| Amazon Linux · 2 | libXfont-debuginfo | 0:1.5.4-1.amzn2.0.1 |
| Amazon Linux · 2 | libXfont-devel | 0:1.5.4-1.amzn2.0.1 |
Vulnerabilities 3
-
High 8.5
libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont
-
High 8.5
libXfont2 PCF Font Parsing Heap Buffer Overflow
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
-
High 8.5
libXfont2 computeProps Property Buffer Heap Buffer Overflow
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.