Most recent entries from all

ALSA-2025:9304 — Important: xorg-x11-server-Xwayland security update

Affected: AlmaLinux:10: xorg-x11-server-Xwayland, AlmaLinux:10: xorg-x11-server-Xwayland-devel

Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-11959

BELL-CVE-2025-49177

Affected: Alpaquita:23: xorg-server, Alpaquita:25: xorg-server, Alpaquita:stream: xorg-server

EUVD-2026-331313

fkie_cve-2025-49177

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

GHSA-pw35-9xmg-v8xw

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

msrc_CVE-2025-49177 — Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

msrc_CVE-2025-49177

openSUSE-SU-2025:15310-1 — xorg-x11-server-21.1.15-6.1 on GA media

xorg-x11-server-21.1.15-6.1 on GA media

RHSA-2025:10258 — Red Hat Security Advisory: xorg-x11-server-Xwayland security update

xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension

SUSE-SU-2025:01974-1 — Security update for xwayland

Security update for xwayland

UBUNTU-CVE-2025-49177

Affected: Ubuntu:Pro:14.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server-hwe-16.04, Ubuntu:Pro:18.04:LTS: xorg-server, Ubuntu:Pro:18.04:LTS: xorg-server-hwe-18.04, Ubuntu:Pro:20.04:LTS: xorg-server, Ubuntu:22.04:LTS: xorg-server, Ubuntu:22.04:LTS: xwayland, Ubuntu:24.04:LTS: xorg-server, Ubuntu:24.04:LTS: xwayland and 4 more

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

WID-SEC-W-2025-1352 — X.Org X11 und Xwayland: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in X.Org X11 und Xwayland ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen und möglicherweise Code auszuführen oder nicht näher spezifizierte Auswirkungen zu erzielen.