In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0760 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-49180:
    A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly     validate input. This issue leads to an integer overflow when computing the total size to allocate.

    CVE-2025-49179:
    A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check     for an integer overflow when computing request length, which allows a client to bypass length checks.

    CVE-2025-49178:
    A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can     cause the server to skip processing another client's request, potentially leading to a denial of service.

    CVE-2025-49176:
    A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking     against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

    CVE-2025-49175:
    A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no     cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

    CVE-2022-49737:
    In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the     main thread modifies various data structures used by the input thread without acquiring a lock, aka a race     condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the     main thread modifies various data structures used by the input thread without acquiring a lock, aka a race     condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock. (CVE-2022-49737)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-939 advisory.

    In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the     main thread modifies various data structures used by the input thread without acquiring a lock, aka a race     condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock. (CVE-2022-49737)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0984-1 advisory.

    - CVE-2022-49737: Fixed Xorg crashing when client applications use easystroke for       mouse gestures (bsc#1239750)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271102	TencentOS Server 4: xorg-x11-server (TSSA-2025:0760)	Nessus	Tencent Local Security Checks	high
258922	Linux Distros Unpatched Vulnerability : CVE-2022-49737	Nessus	Misc.	high
234338	Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2025-939)	Nessus	Amazon Linux Local Security Checks	high
233208	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xorg-x11-server (SUSE-SU-2025:0984-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-49737

high

Tenable Plugins

high

high

high

high