The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1066 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-59679:
    A flaw was found in libXfont2. fs_read_glyphs() in the font-server client (src/fc/fserve.c) indexes the     per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was     allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two values     are never cross-checked, so a malicious font server can send a small num_extents followed by a large     num_chars to cause out-of-bounds heap reads and out-of-bounds writes. When the X server runs as root, this     can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of     service (crash).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_55446 advisory.

    * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)

    * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client     (CVE-2026-44950)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787162017 advisory.

  - fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a     single buffer. Existing checks validates only that the source slice (position, length) lies within the     source bitmap buffer. It does not check whether the running destination cursor has exceeded the     allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each     referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing     validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap     buffer overflow with attacker-controlled content. (CVE-2026-44950)

  - fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character     encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a     size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never     cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents     reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-     bounds heap read and writes. (CVE-2026-59679)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a     malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to     properly validate the total size of the incoming data, leading to an overwrite of memory beyond the     intended buffer. If the X server runs as a privileged user, this could result in privilege escalation,     allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to     a denial of service, causing the system to crash.(CVE-2026-44950)

    A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font     server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client     incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privilege     escalation if the X server runs with root privileges, or a denial of service (crash) if it runs as an     unprivileged user.(CVE-2026-59679)

    A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in     libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using     authenticated X clients to execute code within the X server.(CVE-2026-56003)

    A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows     attackers authenticated as X client to execute code within the X server.(CVE-2026-56002)

    A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size     could be used by attackers able to access the X Server to execute code within the X server     cont(CVE-2026-56001)

Tenable has extracted the preceding description block directly from the EulerOS libXfont2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141785 advisory.

    fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character     encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a     size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never     cross-checked.
    A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a     large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap     read and writes.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character     encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a     size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never     cross-checked.
    A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a     large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap     read and writes.(CVE-2026-59679)

    fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a     single buffer. Existing checks validates only that the source slice (position, length) lies within the     source bitmap buffer. It does not check whether the running destination cursor has exceeded the     allocation.

    A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing     {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but     the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow     with attacker-controlled content.(CVE-2026-44950)

Tenable has extracted the preceding description block directly from the EulerOS libXfont2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
353454	TencentOS Server 4: libXfont2 (TSSA-2026:1066)	Nessus	Tencent Local Security Checks	2026/9/30	2026/9/30	critical
354951	Rocky Linux 8 [CIQ] Security Update: libXfont2 / libXfont2-debuginfo / libXfont2-debugsource / etc Multiple Vulnerabilities (crlsa-2026_55446)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
359984	Rocky Linux 9.6 [TuxCare] Security Update: libXfont2 / libXfont2-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787162017)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
364940	EulerOS 2.0 SP11 : libXfont2 (EulerOS-SA-2026-4334)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical
369062	Unity Linux 20.1070a Security Update: libXfont2 (UTSA-2026-141785)	Nessus	Unity Linux Local Security Checks	2026/10/21	2026/10/21	critical
376786	EulerOS 2.0 SP12 : libXfont2 (EulerOS-SA-2026-4412)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical