-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 24 Jun 2026 14:06:35 +0200 Source: xorg-server Binary: xorg-server-source xserver-common Architecture: all Version: 2:21.1.16-1.3+deb13u3 Distribution: trixie-security Urgency: high Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) Changed-By: Salvatore Bonaccorso Description: xorg-server-source - Xorg X server - source files xserver-common - common files used by various X servers Closes: 1138680 Changes: xorg-server (2:21.1.16-1.3+deb13u3) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * sync: fix deletion of counters and fences (CVE-2026-50257, CVE-2026-50260) (Closes: #1138680) * sync: restart trigger list iteration in SyncChangeCounter after TriggerFired (CVE-2026-50261) (Closes: #1138680) * xkb: reject key types with num_levels exceeding XkbMaxShiftLevel (CVE-2026-50258) (Closes: #1138680) * xkb: clamp nMaps to mapWidths buffer size in CheckKeyTypes (CVE-2026-50259) (Closes: #1138680) * glx: fix reversed length check in ChangeDrawableAttributes (CVE-2026-50262) (Closes: #1138680) * saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow (CVE-2026-50263) (Closes: #1138680) * dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN (CVE-2026-50256) (Closes: #1138680) * dri2: Use booleans for (fake) front buffer tracking in do_get_buffers (CVE-2026-50264) (Closes: #1138680) * dri2: Deduplicate attachments in do_get_buffer (CVE-2026-50264) (Closes: #1138680) Checksums-Sha1: aacdab02f130cba2d3fe25f769084b442c6ab438 7518124 xorg-server-source_21.1.16-1.3+deb13u3_all.deb e88bfefdc787e178292d00bca91bc25421158485 11613 xorg-server_21.1.16-1.3+deb13u3_all-buildd.buildinfo 9d0862098a3a832c261be3b859e6c25697cd4e63 2410088 xserver-common_21.1.16-1.3+deb13u3_all.deb Checksums-Sha256: 86f22d277c8b9f52e4d795129eb92fcc5a3e5755df3dd730178ae26b97e4d0dd 7518124 xorg-server-source_21.1.16-1.3+deb13u3_all.deb 68cf85dd08704f31f606a71f9cbca61c41eab80ff5af5badef8d4a32b6996fc4 11613 xorg-server_21.1.16-1.3+deb13u3_all-buildd.buildinfo dc1d37303c103b23c40cd1ea694c5c6561e0e8dc1734a73c7a0ae0ef080e7fcc 2410088 xserver-common_21.1.16-1.3+deb13u3_all.deb Files: 55b44d8e76ba7b1f1bd4b21686a3c8e8 7518124 x11 optional xorg-server-source_21.1.16-1.3+deb13u3_all.deb 739f58e07fee2b42ed0cdf6baba8c747 11613 x11 optional xorg-server_21.1.16-1.3+deb13u3_all-buildd.buildinfo 4fb06dfe4008a0e40996408ddbd37153 2410088 x11 optional xserver-common_21.1.16-1.3+deb13u3_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmo8Ln4ACgkQN8Ugyu9d QiQiyBAAuqz4fNpiHNoRQXiN5D1IRGMEYkventDBhXf1cEtnhDr39ZJVC5e4CYua +UeXXDlj53T6Z23iZE/Srda2s12A7lgqyjoiN+ThtPDE3N/NAZONYaA5N+doqNLn k2s3m7W0iKbZCjnhE2RnX/BDspzsPRu0LACHkX2YVtChq2VYR+0P9eyAvkJbEI8L HeW9qqDuJC54EQQ9VJJYPivvGcKSLDFZORz59rmX2u8IEoUm0bJD05nsjI2MK2Xb 3qhw1L2StFTD0dA1PosLneooK8hDLJZOZnW7qmSBqhaqpWrlEVCptsHTkxZSXLpA YuLFDYjtOXIrwprErgVw7W9kOL/i0mnY9RhRnVfWGGQN8/HASbNphbV7kjYUmqf9 GpamRH0HikSRqVLuusdfNXLKNC86QaXZ97AC16Yc7VoSAGOAKYwstWK6PGr+ZdCz p9AFA8oxbClOf/jHFd2RizwLzQbD3walfhryV6w0hif/st4qHVG+myDeuZPdJUlH BRQ3MpQq1ypkgB6KDz+mhILPa6lggivsaCTX2hnBVMc7gM826pB+NFBkjd+gzDuV RpUff4EjPptDWBzB7eMKQlwy/gtQyitzVP2TH65n6e4hQ/8a9nM5jlbQlhAK8uPU Olw5HLEK1cY9AxoeOEO27mNa8nnE17VEm5YRsZZYtJbVM/1slTs= =iFQO -----END PGP SIGNATURE-----