Slackware Linux Security Team released new packages for Slackware 15.0 and -current to patch security vulnerabilities in proftpd, xorg-server, and libXfont2. The proftpd update resolves numerous flaws including stack buffer overflows in MLSD/MLST handling, SQL injection risks in group name lookups, and bypasses of transfer limits that compromise data integrity. Updates for xorg-server address heap buffer overflows in the glamor Font Atlas and a use-after-free error in GLX context tags, linked to CVE-2026-55999 and CVE-2026-56000. The libXfont2 upgrade mitigates three integer overflow and heap buffer overflow issues within bitmap scaling, PCF font parsing, and property computation functions, associated with CVE-2026-56001 through CVE-2026-56003.

proftpd (SSA:2026-189-02)
xorg-server (SSA:2026-189-03)
libXfont2 (SSA:2026-189-01)

proftpd (SSA:2026-189-02)

proftpd (SSA:2026-189-02)

New proftpd packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/proftpd-1.3.9c-i586-1_slack15.0.txz: Upgraded.
This update fixes bugs and security issues:
ExecEnviron values not passed due to regression since 1.3.8.d.
Stack buffer overflow in MLSD/MLST handling for long path names.
MaxTransfersPerUser no longer enforces configured limits.
AdminControlsACLs for config, get actions not honored as they should be.
Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
buffers without bounds checking.
RewriteMap unescape builtin use causes one-byte out-of-bounds write,
fails to reject illegal characters.
SQL group name lookup concatenates client-provided group names without
escaping.
Authenticated SFTP sessions can overflow the SFTP packet buffer.
Default Controls socket ACLs unintentionally allow all users access for
sending Controls requests.
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/proftpd-1.3.9c-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/proftpd-1.3.9c-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/proftpd-1.3.9c-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/proftpd-1.3.9c-x86_64-1.txz

MD5 signatures:
+-------------+

Slackware 15.0 package:
5e957bcf4abf13fc957520d6987eb954 proftpd-1.3.9c-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
7506a63751fc4996465a2c83e9174eae proftpd-1.3.9c-x86_64-1_slack15.0.txz

Slackware -current package:
eb1aa81c4db3a984dc39f9e75438e067 n/proftpd-1.3.9c-i686-1.txz

Slackware x86_64 -current package:
d28ec7ff480ab4121deb30c59c73e9ca n/proftpd-1.3.9c-x86_64-1.txz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg proftpd-1.3.9c-i586-1_slack15.0.txz

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key

xorg-server (SSA:2026-189-03)

xorg-server (SSA:2026-189-03)

New xorg-server packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/xorg-server-1.20.14-i586-21_slack15.0.txz: Rebuilt.
This update fixes security issues:
glamor Font Atlas Heap Buffer Overflow.
GLX contextTags Use-After-Free in CommonMakeCurrent().
For more information, see:
https://lists.x.org/archives/xorg/2026-July/062255.html
https://www.cve.org/CVERecord?id=CVE-2026-55999
https://www.cve.org/CVERecord?id=CVE-2026-56000
(* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-21_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-21_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-21_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-19_slack15.0.txz: Rebuilt.
This update fixes security issues:
glamor Font Atlas Heap Buffer Overflow.
GLX contextTags Use-After-Free in CommonMakeCurrent().
For more information, see:
https://lists.x.org/archives/xorg/2026-July/062255.html
https://www.cve.org/CVERecord?id=CVE-2026-55999
https://www.cve.org/CVERecord?id=CVE-2026-56000
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-1.20.14-i586-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xephyr-1.20.14-i586-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xnest-1.20.14-i586-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xvfb-1.20.14-i586-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xwayland-21.1.4-i586-19_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-1.20.14-x86_64-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xephyr-1.20.14-x86_64-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xnest-1.20.14-x86_64-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xvfb-1.20.14-x86_64-21_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xwayland-21.1.4-x86_64-19_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-21.1.24-i686-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xephyr-21.1.24-i686-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xnest-21.1.24-i686-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xvfb-21.1.24-i686-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xwayland-24.1.13-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-21.1.24-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xephyr-21.1.24-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xnest-21.1.24-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xvfb-21.1.24-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xwayland-24.1.13-x86_64-1.txz

MD5 signatures:
+-------------+

Slackware 15.0 package:
8ee8e09c8bf7ad2f7736e0b3a34526fa xorg-server-1.20.14-i586-21_slack15.0.txz
9445a8151fcef066aab50f6889d9020e xorg-server-xephyr-1.20.14-i586-21_slack15.0.txz
3410bdb7f3dad90a39739ff1f6eeac31 xorg-server-xnest-1.20.14-i586-21_slack15.0.txz
478ab900a8bf22df2ef173cfdefbabbb xorg-server-xvfb-1.20.14-i586-21_slack15.0.txz
a132025f9509f12a96a8b374ed257496 xorg-server-xwayland-21.1.4-i586-19_slack15.0.txz

Slackware x86_64 15.0 package:
1c85ac7c5d1033fc41354b33fe18bdcd xorg-server-1.20.14-x86_64-21_slack15.0.txz
5f03471488a9b6bf826b9ab1bdc2d4c2 xorg-server-xephyr-1.20.14-x86_64-21_slack15.0.txz
4d5bc9fcf635f9bc0dccdf11da884afc xorg-server-xnest-1.20.14-x86_64-21_slack15.0.txz
17a79b491be51e4730ae417116cc51d2 xorg-server-xvfb-1.20.14-x86_64-21_slack15.0.txz
a150bb8ba91cf5c9013602ef583cc120 xorg-server-xwayland-21.1.4-x86_64-19_slack15.0.txz

Slackware -current package:
3a6b1e86333ef9653b4982d653d5d8b7 x/xorg-server-21.1.24-i686-1.txz
17b3c4516dff4c42231a1b2eeca9fbdc x/xorg-server-xephyr-21.1.24-i686-1.txz
c998ffd8de120deec1dcfd12117d3bbb x/xorg-server-xnest-21.1.24-i686-1.txz
590199de49ccdb9e55bfe323996e4178 x/xorg-server-xvfb-21.1.24-i686-1.txz
d0b18dca7a226e9a606c8e199c5b0b15 x/xorg-server-xwayland-24.1.13-i686-1.txz

Slackware x86_64 -current package:
9eb2c4a86ccaff313b51b2be39d443b1 x/xorg-server-21.1.24-x86_64-1.txz
744a967005e978277b9638bf6b6b5acf x/xorg-server-xephyr-21.1.24-x86_64-1.txz
eb49ee6f09618a0649d6e75e81499fa9 x/xorg-server-xnest-21.1.24-x86_64-1.txz
b216eac69f4f7dac6e521e4be4904171 x/xorg-server-xvfb-21.1.24-x86_64-1.txz
193b4f96655202b5002bbfbcde68975b x/xorg-server-xwayland-24.1.13-x86_64-1.txz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg xorg-server-*.txz

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key

libXfont2 (SSA:2026-189-01)

libXfont2 (SSA:2026-189-01)

New libXfont2 packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/libXfont2-2.0.8-i586-1_slack15.0.txz: Upgraded.
This update fixes security issues:
BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow.
PCF Font Parsing Heap Buffer Overflow.
computeProps Property Buffer Heap Buffer Overflow.
For more information, see:
https://lists.x.org/archives/xorg/2026-July/062253.html
https://www.cve.org/CVERecord?id=CVE-2026-56001
https://www.cve.org/CVERecord?id=CVE-2026-56002
https://www.cve.org/CVERecord?id=CVE-2026-56003
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/libXfont2-2.0.8-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/libXfont2-2.0.8-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/libXfont2-2.0.8-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/libXfont2-2.0.8-x86_64-1.txz

MD5 signatures:
+-------------+

Slackware 15.0 package:
15a36c81b360d94bc803b65560d94934 libXfont2-2.0.8-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
11450cfb5cfb79181d49bcd02cc81554 libXfont2-2.0.8-x86_64-1_slack15.0.txz

Slackware -current package:
a4aa589efa9b9571fcbe729d0c97c524 x/libXfont2-2.0.8-i686-1.txz

Slackware x86_64 -current package:
719ba3cd0d28b303f6b78d16195ad879 x/libXfont2-2.0.8-x86_64-1.txz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg libXfont2-2.0.8-i586-1_slack15.0.txz

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key