Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-49180: A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate. CVE-2025-49179: The RecordSanityCheckRegisterClients() function in the X Record extension implementation of the Xserver checks for the request length, but does not check for integer overflow. A client might send a very large value for either the number of clients or the number of protocol ranges that will cause an integer overflow in the request length computation, defeating the check for request length. CVE-2025-49178: A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service. CVE-2025-49176: A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check. CVE-2025-49175: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | tigervnc | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-debuginfo | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-icons | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-license | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-server | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-server-applet | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-server-minimal | 0:1.8.0-24.amzn2.0.6 |
| Amazon Linux · 2 | tigervnc-server-module | 0:1.8.0-24.amzn2.0.6 |
Vulnerabilities 5
-
High 7.8
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension
A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
-
High 7.3
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension
A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
-
High 7.3
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension
A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
-
Medium 6.1
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors
A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
-
Medium 5.5
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-49175.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-49176.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-49178.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-49179.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-49180.html