{"id":"ECHO-17d4-e111-8183","summary":"Out-of-bounds read of the encoding[] array in fs_read_glyphs() in the\nfont-server client (src/fc/fserve.c). Debian builds libXfont2 with\n--disable-fc (debian/rules), so the font-server client is not compiled:\nthe shipped libXfont2.so.2.0.0 (1:2.0.6-1+deb13u1) contains no\nfs_read_glyphs or other fserve code. Debian rates it unimportant\n(\"Disabled support to connect to font server since 1:1.4.7-1\").\n","modified":"2026-10-11T08:45:03.069282547Z","published":"2026-08-05T10:11:56.930Z","withdrawn":"2026-10-11T08:00:12.149Z","upstream":["CVE-2026-59679"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-59679"},{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-59679"}],"affected":[{"package":{"name":"libxfont","ecosystem":"Echo","purl":"pkg:deb/echo/libxfont"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.6-1+deb13u1"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-17d4-e111-8183.json"}}],"schema_version":"1.9.0"}