{"id":"CVE-2025-49177","aliases":["ALPINE-CVE-2025-49177","ALSA-2025:9304","AZL-64271","BELL-CVE-2025-49177","DEBIAN-CVE-2025-49177","DSA-5947-1","EUVD-2025-18499","GHSA-pw35-9xmg-v8xw","MGASA-2025-0199","RHSA-2025:10258","RHSA-2025:9303","RHSA-2025:9304","RLSA-2025:9304","SUSE-SU-2025:01974-1","SUSE-SU-2025:01975-1","SUSE-SU-2025:01979-1","SUSE-SU-2025:01980-1","SUSE-SU-2025:01981-1","UBUNTU-CVE-2025-49177","USN-7573-1","openSUSE-SU-2025:15310-1","openSUSE-SU-2025:15311-1"],"status":"published","title":"Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0044,"percentile":0.3867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2025-06-17T00:00:00Z","modified":"2026-11-06T01:21:21Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"xorg-server","fixed_in":["21.1.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xorg-server","fixed_in":["21.1.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xorg-server","fixed_in":["21.1.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xwayland","fixed_in":["24.1.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xwayland","fixed_in":["24.1.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xwayland","fixed_in":["24.1.7-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xorg-x11-server-Xwayland","fixed_in":["24.1.6-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xorg-server","fixed_in":["21.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"xorg-server","fixed_in":["21.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xorg-server","fixed_in":["21.1.17-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:21.1.7-3+deb12u10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:21.1.16-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:21.1.16-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xwayland","fixed_in":["2:24.1.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","fixed_in":["2:21.1.4-2ubuntu1.7~22.04.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","fixed_in":["2:22.1.1-1ubuntu0.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","fixed_in":["2:21.1.12-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xwayland","fixed_in":["2:23.2.6-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"xorg-server","fixed_in":["2:21.1.18-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"xwayland","fixed_in":["2:24.1.6-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"xorg-server","fixed_in":["2:21.1.18-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"xwayland","fixed_in":["2:24.1.6-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.16-r0"},{"fixed":"21.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.17-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u10"}]}],"versions":["2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6","2:21.1.7-3+deb12u7","2:21.1.7-3+deb12u8","2:21.1.7-3+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.16-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.16-1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:22.1.9-1","2:23.1.0-1","2:23.1.1-1","2:23.2.0-1","2:23.2.1-1","2:23.2.2-1","2:23.2.3-1","2:23.2.4-1","2:23.2.6-1","2:24.0.99.901-1","2:24.1.0-1","2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.2-1","2:24.1.3-1","2:24.1.4-1","2:24.1.4-2","2:24.1.4-3","2:24.1.5-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:24.1.8-1"}]}],"versions":["2:24.1.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u10"}]}],"versions":["2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6","2:21.1.7-3+deb12u7","2:21.1.7-3+deb12u8","2:21.1.7-3+deb12u9"],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.8-7.8.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"x11-server-xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.9-1.8.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2.8.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.1.9-6.el9_4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.1.9-6.el9_4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.1.9-6.el9_4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xdmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xdmx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xephyr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xephyr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xnest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xnest-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xorg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xvfb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xvfb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xdmx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xephyr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xnest-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xorg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xvfb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-4.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.11-31.el9_6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-4.el10_0"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.1-150600.5.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.1-150600.5.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.5-150700.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.11-150600.5.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.11-150600.5.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.11-150600.5.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.15-150700.5.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.15-150700.5.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10","2:1.15.1-0ubuntu2.11","2:1.15.1-0ubuntu2.11+esm2","2:1.15.1-0ubuntu2.11+esm3","2:1.15.1-0ubuntu2.11+esm4","2:1.15.1-0ubuntu2.11+esm5","2:1.15.1-0ubuntu2.11+esm6","2:1.15.1-0ubuntu2.11+esm7","2:1.15.1-0ubuntu2.11+esm8","2:1.15.1-0ubuntu2.11+esm9","2:1.15.1-0ubuntu2.11+esm11","2:1.15.1-0ubuntu2.11+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6","2:1.18.4-0ubuntu0.7","2:1.18.4-0ubuntu0.8","2:1.18.4-0ubuntu0.9","2:1.18.4-0ubuntu0.10","2:1.18.4-0ubuntu0.11","2:1.18.4-0ubuntu0.12","2:1.18.4-0ubuntu0.12+esm1","2:1.18.4-0ubuntu0.12+esm2","2:1.18.4-0ubuntu0.12+esm4","2:1.18.4-0ubuntu0.12+esm5","2:1.18.4-0ubuntu0.12+esm6","2:1.18.4-0ubuntu0.12+esm8","2:1.18.4-0ubuntu0.12+esm9","2:1.18.4-0ubuntu0.12+esm10","2:1.18.4-0ubuntu0.12+esm12","2:1.18.4-0ubuntu0.12+esm13","2:1.18.4-0ubuntu0.12+esm14","2:1.18.4-0ubuntu0.12+esm15","2:1.18.4-0ubuntu0.12+esm16","2:1.18.4-0ubuntu0.12+esm17","2:1.18.4-0ubuntu0.12+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1","2:1.19.6-1ubuntu4.1~16.04.2","2:1.19.6-1ubuntu4.1~16.04.3","2:1.19.6-1ubuntu4.1~16.04.4","2:1.19.6-1ubuntu4.1~16.04.5","2:1.19.6-1ubuntu4.1~16.04.6","2:1.19.6-1ubuntu4.1~16.04.6+esm1","2:1.19.6-1ubuntu4.1~16.04.6+esm3","2:1.19.6-1ubuntu4.1~16.04.6+esm4","2:1.19.6-1ubuntu4.1~16.04.6+esm5","2:1.19.6-1ubuntu4.1~16.04.6+esm6","2:1.19.6-1ubuntu4.1~16.04.6+esm7","2:1.19.6-1ubuntu4.1~16.04.6+esm8","2:1.19.6-1ubuntu4.1~16.04.6+esm9","2:1.19.6-1ubuntu4.1~16.04.6+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1","2:1.19.6-1ubuntu4.2","2:1.19.6-1ubuntu4.3","2:1.19.6-1ubuntu4.4","2:1.19.6-1ubuntu4.5","2:1.19.6-1ubuntu4.6","2:1.19.6-1ubuntu4.7","2:1.19.6-1ubuntu4.8","2:1.19.6-1ubuntu4.9","2:1.19.6-1ubuntu4.10","2:1.19.6-1ubuntu4.11","2:1.19.6-1ubuntu4.12","2:1.19.6-1ubuntu4.13","2:1.19.6-1ubuntu4.14","2:1.19.6-1ubuntu4.15","2:1.19.6-1ubuntu4.15+esm1","2:1.19.6-1ubuntu4.15+esm3","2:1.19.6-1ubuntu4.15+esm4","2:1.19.6-1ubuntu4.15+esm5","2:1.19.6-1ubuntu4.15+esm7","2:1.19.6-1ubuntu4.15+esm8","2:1.19.6-1ubuntu4.15+esm9","2:1.19.6-1ubuntu4.15+esm10","2:1.19.6-1ubuntu4.15+esm11","2:1.19.6-1ubuntu4.15+esm12","2:1.19.6-1ubuntu4.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server-hwe-18.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.1-3ubuntu2.1~18.04.1","2:1.20.4-1ubuntu3~18.04.1","2:1.20.5+git20191008-0ubuntu1~18.04.1","2:1.20.8-2ubuntu2.1~18.04.1","2:1.20.8-2ubuntu2.2~18.04.1","2:1.20.8-2ubuntu2.2~18.04.2","2:1.20.8-2ubuntu2.2~18.04.3","2:1.20.8-2ubuntu2.2~18.04.4","2:1.20.8-2ubuntu2.2~18.04.5","2:1.20.8-2ubuntu2.2~18.04.6","2:1.20.8-2ubuntu2.2~18.04.7","2:1.20.8-2ubuntu2.2~18.04.8","2:1.20.8-2ubuntu2.2~18.04.9","2:1.20.8-2ubuntu2.2~18.04.10","2:1.20.8-2ubuntu2.2~18.04.11","2:1.20.8-2ubuntu2.2~18.04.11+esm1","2:1.20.8-2ubuntu2.2~18.04.11+esm2","2:1.20.8-2ubuntu2.2~18.04.11+esm3","2:1.20.8-2ubuntu2.2~18.04.11+esm4","2:1.20.8-2ubuntu2.2~18.04.11+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.5+git20191008-0ubuntu1","2:1.20.6-1ubuntu1","2:1.20.7-2ubuntu1","2:1.20.7-2ubuntu2","2:1.20.8-2ubuntu2","2:1.20.8-2ubuntu2.1","2:1.20.8-2ubuntu2.2","2:1.20.8-2ubuntu2.3","2:1.20.8-2ubuntu2.4","2:1.20.8-2ubuntu2.6","2:1.20.9-2ubuntu1.1~20.04.1","2:1.20.9-2ubuntu1.2~20.04.1","2:1.20.9-2ubuntu1.2~20.04.2","2:1.20.11-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.3","2:1.20.13-1ubuntu1~20.04.4","2:1.20.13-1ubuntu1~20.04.5","2:1.20.13-1ubuntu1~20.04.6","2:1.20.13-1ubuntu1~20.04.8","2:1.20.13-1ubuntu1~20.04.9","2:1.20.13-1ubuntu1~20.04.12","2:1.20.13-1ubuntu1~20.04.14","2:1.20.13-1ubuntu1~20.04.15","2:1.20.13-1ubuntu1~20.04.16","2:1.20.13-1ubuntu1~20.04.17","2:1.20.13-1ubuntu1~20.04.18","2:1.20.13-1ubuntu1~20.04.19","2:1.20.13-1ubuntu1~20.04.20","2:1.20.13-1ubuntu1~20.04.20+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.4-2ubuntu1.7~22.04.15"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8","2:21.1.4-2ubuntu1.7~22.04.9","2:21.1.4-2ubuntu1.7~22.04.10","2:21.1.4-2ubuntu1.7~22.04.11","2:21.1.4-2ubuntu1.7~22.04.12","2:21.1.4-2ubuntu1.7~22.04.13","2:21.1.4-2ubuntu1.7~22.04.14"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:22.1.1-1ubuntu0.19"}]}],"versions":["2:21.1.2-0ubuntu1","2:21.1.3-1","2:21.1.3-1ubuntu1","2:21.1.4-1","2:22.1.0-1","2:22.1.1-1","2:22.1.1-1ubuntu0.1","2:22.1.1-1ubuntu0.2","2:22.1.1-1ubuntu0.3","2:22.1.1-1ubuntu0.4","2:22.1.1-1ubuntu0.5","2:22.1.1-1ubuntu0.6","2:22.1.1-1ubuntu0.7","2:22.1.1-1ubuntu0.9","2:22.1.1-1ubuntu0.10","2:22.1.1-1ubuntu0.11","2:22.1.1-1ubuntu0.12","2:22.1.1-1ubuntu0.13","2:22.1.1-1ubuntu0.14","2:22.1.1-1ubuntu0.15","2:22.1.1-1ubuntu0.17","2:22.1.1-1ubuntu0.18"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.12-1ubuntu1.4"}]}],"versions":["2:21.1.7-3ubuntu2","2:21.1.7-3ubuntu2.1","2:21.1.10-1ubuntu1","2:21.1.11-2ubuntu1","2:21.1.12-1ubuntu1","2:21.1.12-1ubuntu1.1","2:21.1.12-1ubuntu1.2","2:21.1.12-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:23.2.6-1ubuntu0.6"}]}],"versions":["2:23.2.0-1","2:23.2.0-1ubuntu0.1","2:23.2.3-1","2:23.2.4-1","2:23.2.4-1build1","2:23.2.4-1build2","2:23.2.4-1build3","2:23.2.6-1","2:23.2.6-1ubuntu0.1","2:23.2.6-1ubuntu0.2","2:23.2.6-1ubuntu0.4","2:23.2.6-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.18-1ubuntu1"}]}],"versions":["2:21.1.16-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:24.1.6-1ubuntu1"}]}],"versions":["2:24.1.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.18-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:24.1.6-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.4-2ubuntu1.7~22.04.15"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8","2:21.1.4-2ubuntu1.7~22.04.9","2:21.1.4-2ubuntu1.7~22.04.10","2:21.1.4-2ubuntu1.7~22.04.11","2:21.1.4-2ubuntu1.7~22.04.12","2:21.1.4-2ubuntu1.7~22.04.13","2:21.1.4-2ubuntu1.7~22.04.14"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:22.1.1-1ubuntu0.19"}]}],"versions":["2:21.1.2-0ubuntu1","2:21.1.3-1","2:21.1.3-1ubuntu1","2:21.1.4-1","2:22.1.0-1","2:22.1.1-1","2:22.1.1-1ubuntu0.1","2:22.1.1-1ubuntu0.2","2:22.1.1-1ubuntu0.3","2:22.1.1-1ubuntu0.4","2:22.1.1-1ubuntu0.5","2:22.1.1-1ubuntu0.6","2:22.1.1-1ubuntu0.7","2:22.1.1-1ubuntu0.9","2:22.1.1-1ubuntu0.10","2:22.1.1-1ubuntu0.11","2:22.1.1-1ubuntu0.12","2:22.1.1-1ubuntu0.13","2:22.1.1-1ubuntu0.14","2:22.1.1-1ubuntu0.15","2:22.1.1-1ubuntu0.17","2:22.1.1-1ubuntu0.18"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.12-1ubuntu1.4"}]}],"versions":["2:21.1.7-3ubuntu2","2:21.1.7-3ubuntu2.1","2:21.1.10-1ubuntu1","2:21.1.11-2ubuntu1","2:21.1.12-1ubuntu1","2:21.1.12-1ubuntu1.1","2:21.1.12-1ubuntu1.2","2:21.1.12-1ubuntu1.3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:23.2.6-1ubuntu0.6"}]}],"versions":["2:23.2.0-1","2:23.2.0-1ubuntu0.1","2:23.2.3-1","2:23.2.4-1","2:23.2.4-1build1","2:23.2.4-1build2","2:23.2.4-1build3","2:23.2.6-1","2:23.2.6-1ubuntu0.1","2:23.2.6-1ubuntu0.2","2:23.2.6-1ubuntu0.4","2:23.2.6-1ubuntu0.5"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.15-6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.8-1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"x.org","product":"xwayland"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10258","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9303","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9304","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49177","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369955","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab02fb96b1c701c3bb47617d965522c34befa6af","tags":["fix","article"]},{"url":"https://www.x.org/wiki/Development/Security/","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49177","tags":["web","advisory"]},{"url":"https://www.x.org/wiki/Development/Security"},{"url":"https://github.com/advisories/GHSA-pw35-9xmg-v8xw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-49177","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49175","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49176","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49178","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49179","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49180","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369947","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369954","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369955","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369977","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369978","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369981","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-9304.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-49177","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49177.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-49177","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0199.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34381","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/17/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/18/2","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369981","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10258.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49175","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/0885e0b26225c90534642fe911632ec0779eebee","tags":["article"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49176","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/03731b326a80b582e48d939fe62cb1e2b10400d9","tags":["article"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/4fc4d76b2c7aaed61ed2653f997783a3714c4fe1","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49177","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49178","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49179","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49179","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49180","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b767b16174d3213055947ea7f4f88e10ec6","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9303.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9304.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9304","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501974-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244082","tags":["report"]},{"url":"https://bugzilla.suse.com/1244084","tags":["report"]},{"url":"https://bugzilla.suse.com/1244085","tags":["report"]},{"url":"https://bugzilla.suse.com/1244087","tags":["report"]},{"url":"https://bugzilla.suse.com/1244089","tags":["report"]},{"url":"https://bugzilla.suse.com/1244090","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49180","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501975-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501979-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501980-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501981-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-49177","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7573-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-49175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-49176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-49178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-49179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-49180","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-49177","title":"Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T14:49:49.199Z","modified":"2026-11-04T21:35:45.456Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2025-18499","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T14:49:49Z","modified":"2026-11-04T21:35:45Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-pw35-9xmg-v8xw","title":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not...","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T15:31:09Z","modified":"2025-12-11T18:30:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:05:09.214908Z"}],"nvd":[{"id":"CVE-2025-49177","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T15:15:45.65Z","modified":"2026-11-04T22:17:35.407Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"ALPINE-CVE-2025-49177","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T15:15:45.65Z","modified":"2026-11-03T06:33:00.641224107Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2025-49177","status":"published","published":"2025-06-18T05:59:47.186759Z","modified":"2026-01-26T09:40:30.453393Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-49177","title":"Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T14:49:49.199Z","modified":"2026-11-06T01:21:21.999502618Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-06T02:03:53.554046Z"},{"id":"DEBIAN-CVE-2025-49177","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T15:15:45.65Z","modified":"2026-11-05T10:00:15.668701238Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RHSA-2025:10258","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2025-07-03T10:02:58Z","modified":"2026-07-01T10:07:33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:9303","title":"Red Hat Security Advisory: xorg-x11-server and xorg-x11-server-Xwayland security update","status":"published","published":"2025-06-23T10:03:28Z","modified":"2026-07-01T10:09:47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9304","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2025-06-23T10:03:29Z","modified":"2026-07-01T10:09:47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:9304","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)\n\n* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)\n\n* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)\n\n* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)\n\n* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)\n\n* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:43.568279Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-49177","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T00:00:00Z","modified":"2026-05-20T16:23:35.31528375Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"ALSA-2025:9304","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.  \n\nSecurity Fix(es):  \n\n  * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)\n  * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)\n  * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)\n  * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)\n  * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)\n  * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-10-29T11:58:11.815118Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-64271","title":"CVE-2025-49177 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-2","description":"A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.","status":"published","published":"2025-06-17T15:15:45Z","modified":"2026-06-27T05:26:09Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"DSA-5947-1","title":"xorg-server - security update","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-03-09T02:10:09.865253Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0199","title":"Updated x11-server, x11-server-xwayland \u0026 tigervnc packages fix security vulnerabilities","description":"Out-of-bounds access in X Rendering extension (Animated cursors).\n(CVE-2025-49175)\nInteger overflow in Big Requests Extension. (CVE-2025-49176)\nData leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode).\n(CVE-2025-49177)\nUnprocessed client request via bytes to ignore. (CVE-2025-49178)\nInteger overflow in X Record extension. (CVE-2025-49179)\nInteger overflow in RandR extension (RRChangeProviderProperty).\n(CVE-2025-49180)\n","status":"published","published":"2025-06-28T22:45:32Z","modified":"2026-04-16T04:43:55.594238123Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15310-1","title":"xorg-x11-server-21.1.15-6.1 on GA media","description":"These are all security issues fixed in the xorg-x11-server-21.1.15-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:38.043204Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15311-1","title":"xwayland-24.1.8-1.1 on GA media","description":"These are all security issues fixed in the xwayland-24.1.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:38.196559Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:01974-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).\n- CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).\n- CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).\n- CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).\n- CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).\n- CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).\n","status":"published","published":"2025-06-17T15:28:39Z","modified":"2026-02-04T03:49:50.379547Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:01975-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082)\n- CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084)\n- CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085)\n- CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087)\n- CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089)\n- CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090)\n","status":"published","published":"2025-06-17T15:28:52Z","modified":"2026-02-04T02:20:17.077319Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:01979-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).\n- CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).\n- CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).\n- CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).\n- CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).\n- CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).\n","status":"published","published":"2025-06-17T15:30:13Z","modified":"2026-02-04T04:24:19.809151Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:01980-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).\n- CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).\n- CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).\n- CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).\n- CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).\n- CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).\n","status":"published","published":"2025-06-17T15:30:27Z","modified":"2026-02-04T03:27:27.066695Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:01981-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).\n- CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).\n- CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).\n- CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).\n- CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).\n- CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).\n","status":"published","published":"2025-06-17T15:30:54Z","modified":"2026-02-04T04:30:18.998819Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7573-1","title":"xorg-server, xwayland vulnerabilities","description":"Nils Emmerich discovered that the X.Org X Server incorrectly handled\ncertain memory operations. An attacker could use these issues to cause the\nX Server to crash, leading to a denial of service, obtain sensitive\ninformation, or possibly execute arbitrary code.\n","status":"published","published":"2025-06-17T14:31:12Z","modified":"2026-04-27T18:04:16.809808Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}