Summary
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | xorg-x11-server-Xwayland | 24.1.5-4.el10_0 |
| AlmaLinux · 10 | xorg-x11-server-Xwayland-devel | 24.1.5-4.el10_0 |
Vulnerabilities 6
-
High 7.8
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension
A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
-
High 7.3
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension
A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
-
High 7.3
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension
A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
-
Medium 6.1
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors
A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
-
Medium 6.1
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode
A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
-
Medium 5.5
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
References
-
report
https://access.redhat.com/security/cve/CVE-2025-49175
-
report
https://access.redhat.com/security/cve/CVE-2025-49176
-
report
https://access.redhat.com/security/cve/CVE-2025-49177
-
report
https://access.redhat.com/security/cve/CVE-2025-49178
-
report
https://access.redhat.com/security/cve/CVE-2025-49179
-
report
https://access.redhat.com/security/cve/CVE-2025-49180
-
report
https://bugzilla.redhat.com/2369947
-
report
https://bugzilla.redhat.com/2369954
-
report
https://bugzilla.redhat.com/2369955
-
report
https://bugzilla.redhat.com/2369977
-
report
https://bugzilla.redhat.com/2369978
-
report
https://bugzilla.redhat.com/2369981
-
advisory
https://errata.almalinux.org/10/ALSA-2025-9304.html