Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Fixed packages 3

Vulnerabilities 6

• High 7.8
  CVE-2025-49180

  Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension

  A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

  Red Hat X.Org Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Jun 17, 2025
• High 7.3
  CVE-2025-49176

  Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension

  A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

  Red Hat X.Org Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Jun 17, 2025
• High 7.3
  CVE-2025-49179

  Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension

  A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.

  Red Hat X.Org Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Jun 17, 2025
• Medium 6.1
  CVE-2025-49175

  Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors

  A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

  Red Hat X.Org Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Jun 17, 2025
• Medium 6.1
  CVE-2025-49177

  Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

  A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

  Red Hat X.Org Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Jun 17, 2025
• Medium 5.5
  CVE-2025-49178

  Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore

  A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

  Red Hat X.Org Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Jun 17, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369954
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369955
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369977
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369978
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369981
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10258.json
• report
  https://access.redhat.com/security/cve/CVE-2025-49175
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49175
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49175
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/0885e0b26225c90534642fe911632ec0779eebee
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024
• article
  https://www.x.org/wiki/Development/Security/
• report
  https://access.redhat.com/security/cve/CVE-2025-49176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49176
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/03731b326a80b582e48d939fe62cb1e2b10400d9
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/4fc4d76b2c7aaed61ed2653f997783a3714c4fe1
• report
  https://access.redhat.com/security/cve/CVE-2025-49177
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49177
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49177
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab02fb96b1c701c3bb47617d965522c34befa6af
• report
  https://access.redhat.com/security/cve/CVE-2025-49178
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49178
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49178
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2
• report
  https://access.redhat.com/security/cve/CVE-2025-49179
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49179
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49179
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4
• report
  https://access.redhat.com/security/cve/CVE-2025-49180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49180
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b767b16174d3213055947ea7f4f88e10ec6