diff -u libxfont-2.0.1/debian/changelog libxfont-2.0.1/debian/changelog
--- libxfont-2.0.1/debian/changelog
+++ libxfont-2.0.1/debian/changelog
@@ -1,3 +1,12 @@
+libxfont (1:2.0.1-4ubuntu1) bionic; urgency=medium
+
+  * SECURITY UPDATE: non-privileged arbitrary file access
+    - src/fontfile/dirfile.c, src/fontfile/fileio.c: open files with
+      O_NOFOLLOW.
+    - CVE-2017-16611
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Nov 2017 15:10:48 -0500
+
 libxfont (1:2.0.1-4) unstable; urgency=high
 
   * Check for end of string in PatternMatch (CVE-2017-13720)
diff -u libxfont-2.0.1/debian/control libxfont-2.0.1/debian/control
--- libxfont-2.0.1/debian/control
+++ libxfont-2.0.1/debian/control
@@ -1,7 +1,8 @@
 Source: libxfont
 Section: x11
 Priority: optional
-Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
 Uploaders: Timo Aaltonen <tjaalton@debian.org>
 Build-Depends:
  debhelper (>= 10),
only in patch2:
unchanged:
--- libxfont-2.0.1.orig/src/fontfile/dirfile.c
+++ libxfont-2.0.1/src/fontfile/dirfile.c
@@ -42,6 +42,7 @@
 #include <stdio.h>
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <fcntl.h>
 #include <errno.h>
 #include <limits.h>
 
@@ -61,8 +62,9 @@
     char        dir_file[MAXFONTFILENAMELEN];
     char	dir_path[MAXFONTFILENAMELEN];
     char	*ptr;
-    FILE       *file;
-    int         count,
+    FILE       *file = 0;
+    int         file_fd,
+                count,
                 num_fonts,
                 status;
     struct stat	statb;
@@ -92,7 +94,14 @@
     if (dir_file[strlen(dir_file) - 1] != '/')
 	strcat(dir_file, "/");
     strcat(dir_file, FontDirFile);
+#ifndef WIN32
+    file_fd = open(dir_file, O_RDONLY | O_NOFOLLOW);
+    if (file_fd >= 0) {
+	file = fdopen(file_fd, "rt");
+    }
+#else
     file = fopen(dir_file, "rt");
+#endif
     if (file) {
 #ifndef WIN32
 	if (fstat (fileno(file), &statb) == -1)
@@ -262,7 +271,8 @@
     char		alias[MAXFONTNAMELEN];
     char		font_name[MAXFONTNAMELEN];
     char		alias_file[MAXFONTFILENAMELEN];
-    FILE		*file;
+    int			file_fd;
+    FILE		*file = 0;
     FontDirectoryPtr	dir;
     int			token;
     char		*lexToken;
@@ -280,7 +290,16 @@
 	    strcat(alias_file, "/");
 	strcat(alias_file, FontAliasFile);
     }
+
+#ifndef WIN32
+    file_fd = open(alias_file, O_RDONLY | O_NOFOLLOW);
+    if (file_fd >= 0) {
+	file = fdopen(file_fd, "rt");
+    }
+#else
     file = fopen(alias_file, "rt");
+#endif
+
     if (!file)
 	return ((errno == ENOENT) ? Successful : BadFontPath);
     if (!dir)
only in patch2:
unchanged:
--- libxfont-2.0.1.orig/src/fontfile/fileio.c
+++ libxfont-2.0.1/src/fontfile/fileio.c
@@ -40,6 +40,9 @@
 #ifndef O_CLOEXEC
 #define O_CLOEXEC 0
 #endif
+#ifndef O_NOFOLLOW
+#define O_NOFOLLOW 0
+#endif
 
 FontFilePtr
 FontFileOpen (const char *name)
@@ -48,7 +51,7 @@
     int		len;
     BufFilePtr	raw, cooked;
 
-    fd = open (name, O_BINARY|O_CLOEXEC);
+    fd = open (name, O_BINARY|O_CLOEXEC|O_NOFOLLOW);
     if (fd < 0)
 	return 0;
     raw = BufFileOpenRead (fd);