Hi,

The following vulnerabilities were published for libx11.

CVE-2026-94283[0]:
| An out-of-bounds read vulnerability in libX11's XIM (X Input Method)
| attribute parser in libX11 before 1.8.14 could be used by malicious
| X servers to crash attached X clients.


CVE-2026-94284[1]:
| An out-of-bounds read vulnerability in libX11's XIM trigger-key
| registration parser in libX11 before 1.8.14 could be used by
| malicious X servers to crash attached X clients.


CVE-2026-94285[2]:
| An out-of-bounds read in libX11's byte-oriented codeset parser in
| libX11 before 1.8.14 could be used by malicious X servers to crash
| attached X clients.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94283
https://www.cve.org/CVERecord?id=CVE-2026-94283
[1] https://security-tracker.debian.org/tracker/CVE-2026-94284
https://www.cve.org/CVERecord?id=CVE-2026-94284
[2] https://security-tracker.debian.org/tracker/CVE-2026-94285
https://www.cve.org/CVERecord?id=CVE-2026-94285
[3] https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libx11, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149668@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emilio Pozuelo Monfort <pochu@debian.org> (supplier of updated libx11 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 26 Oct 2026 19:51:55 +0100
Source: libx11
Architecture: source
Version: 2:1.8.14-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
Changed-By: Emilio Pozuelo Monfort <pochu@debian.org>
Closes: 1148733 1149668
Changes:
 libx11 (2:1.8.14-1) unstable; urgency=medium
 .
   * New upstream release (closes: #1148733, #1149668)
     - CVE-2026-88806: out-of-bounds write vulnerability in XKB action
       parser.
     - CVE-2026-94283: out-of-bounds read vulnerability in XIM attribute
       parser.
     - CVE-2026-94284: out-of-bounds read vulnerability in XIM trigger-key
       registration parser.
     - CVE-2026-94285: out-of-bounds read in byte-oriented codeset parser.
   * debian/control: build-depend on pkgconf instead of pkg-config.
Checksums-Sha1:
 74521ff501ef9cf256eafc06c3f0b26f88525688 2243 libx11_1.8.14-1.dsc
 3a83227be31a800fade04ab1ecde271449a2597a 3223041 libx11_1.8.14.orig.tar.gz
 fe3c1a19e8d70d3f73d1f7b0fa95f8e826bf5afd 77209 libx11_1.8.14-1.diff.gz
 c6f9db0483df50d56909e8a11f0235b77092e366 6308 libx11_1.8.14-1_source.buildinfo
Checksums-Sha256:
 caf77758cf76511d937b4f876d254f28ea05fd83a35f09fa09e597942094bbcc 2243 libx11_1.8.14-1.dsc
 ebb8a58549ddde50aa2e742b3b256557f451053d173be8dbfc2e8ac078eee1d6 3223041 libx11_1.8.14.orig.tar.gz
 d8a820cabaceedcdf0d74318133eab8d3f4bc69d1f7b08f8a8af1eab94cb77c2 77209 libx11_1.8.14-1.diff.gz
 dbe60dfd8aebea50751f2eb84399f552c04b19b14cda77b25249e40a440586e0 6308 libx11_1.8.14-1_source.buildinfo
Files:
 1b94b18eae3cca5f44d8f3ec07b7c487 2243 x11 optional libx11_1.8.14-1.dsc
 a1072c434da25b78dd7263e4456211e3 3223041 x11 optional libx11_1.8.14.orig.tar.gz
 95b6dbe16d348766e95e42d37ed1d958 77209 x11 optional libx11_1.8.14-1.diff.gz
 25f558480fb1cde2d5477013be0b2342 6308 x11 optional libx11_1.8.14-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmrgUsgACgkQnUbEiOQ2
gwIFeQ//TGdOKtMBX8IqiZ38epWbAt6Qku7DOPY79VNqxjSxdVqJClu6lG5qLb01
CNtfP5qCjxBoc/oYB39vYKa+dmuPHNLXkQRZoiPUpsGZrOhg7IwdrMaHxyolHEqs
WXI39YE3E6HpMVBDq1vtEQrzJRl+Fxd7ckDgR0gaYcDsp9mEcgC0tOKW8n/Kzo+R
5/ZGPOTOET9jR/3f72cTEVH/oyAvchF+tOOWrvnXSMAEOpmyPJTg8u9Ijz6tUTBR
Ha6HlDVd/mpSfb8MSvIzB+SCG6Jxc5xAof8iJJD+5KOhW+k6OWrNO3Euc0VgT3MO
jYMNrvCiSkWfSX1ll1S2fvEwoMuib1p0pnwCD74jdJA7Robg755YOd+M0QttiRfg
E0bZc4lc0pZ/vBl8CIZTIEPWDdLqvGH4BCa7nn7palTWFsbzw7OJNb3oh3zigknU
3uOUsCmVQsca4X3LH9hXLmxOUxn/xbS509xelyz7LcX93yhBGdgRvgJBHWO/NjeP
UvY9zR6+cmm3oxReyCyqmkzy+vwdDfryTes+X/gSgLqbIP3gT+VPIlBN5ToJfT1V
4/7dP61lEfxqioywIDTM22sDe5N4i2jtfnyJy7YUxn3B1326BWUJzCojzCz78h42
sD4DIidWCoN6FdE+10Dl7l5BWfdNOmCjEPQ9wxvBrH5NtYNHnqg=
=RBlh
-----END PGP SIGNATURE-----