A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1060 advisory.

    A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no     cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
    (CVE-2025-49175)

    A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking     against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
    (CVE-2025-49176)

    A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the     request length, allowing a client to read unintended memory from previous requests. (CVE-2025-49177)

    A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can     cause the server to skip processing another client's request, potentially leading to a denial of service.
    (CVE-2025-49178)

    The RecordSanityCheckRegisterClients() function in the X Record extension implementation of the Xserver     checks for the request length, but does not check for integer overflow.

    A client might send a very large value for either the number of clients or the number of protocol ranges     that will cause an integer overflow in the request length computation, defeating the check for request     length. (CVE-2025-49179)

    A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly     validate input. This issue leads to an integer overflow when computing the total size to allocate.
    (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1062 advisory.

    A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no     cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
    (CVE-2025-49175)

    A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking     against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
    (CVE-2025-49176)

    A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the     request length, allowing a client to read unintended memory from previous requests. (CVE-2025-49177)

    A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can     cause the server to skip processing another client's request, potentially leading to a denial of service.
    (CVE-2025-49178)

    The RecordSanityCheckRegisterClients() function in the X Record extension implementation of the Xserver     checks for the request length, but does not check for integer overflow.

    A client might send a very large value for either the number of clients or the number of protocol ranges     that will cause an integer overflow in the request length computation, defeating the check for request     length. (CVE-2025-49179)

    A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly     validate input. This issue leads to an integer overflow when computing the total size to allocate.
    (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1061 advisory.

    A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no     cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
    (CVE-2025-49175)

    A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking     against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
    (CVE-2025-49176)

    A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the     request length, allowing a client to read unintended memory from previous requests. (CVE-2025-49177)

    A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can     cause the server to skip processing another client's request, potentially leading to a denial of service.
    (CVE-2025-49178)

    The RecordSanityCheckRegisterClients() function in the X Record extension implementation of the Xserver     checks for the request length, but does not check for integer overflow.

    A client might send a very large value for either the number of clients or the number of protocol ranges     that will cause an integer overflow in the request length computation, defeating the check for request     length. (CVE-2025-49179)

    A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly     validate input. This issue leads to an integer overflow when computing the total size to allocate.
    (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10258 advisory.

    Xwayland is an X server for running X clients under Wayland.

    Security Fix(es):

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's     XFixesSetClientDisconnectMode (CVE-2025-49177)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b14cabf7-5663-11f0-943a-18c04d5ea3dc advisory.

    The X.Org project reports:
    The X Rendering extension allows creating animated cursors providing a                   list of cursors.
                  By default, the Xserver assumes at least one cursor is provided while a                   client may actually pass no cursor at all, which causes an out-of-bound                   read creating the animated cursor and a crash of the Xserver.
    The handler of XFixesSetClientDisconnectMode does not check the client                   request length.
                  A client could send a shorter request and read data from a former                   request.
    When reading requests from the clients, the input buffer might be shared                   and used between different clients.
                  If a given client sends a full request with non-zero bytes to ignore,                   the bytes to ignore may still be non-zero even though the request is                   full, in which case the buffer could be shared with another client who's                   request will not be processed because of those bytes to ignore, leading                   to a possible hang of the other client request.
    The RecordSanityCheckRegisterClients() function in the X Record extension                   implementation of the Xserver checks for the request length, but does not                   check for integer overflow.
                  A client might send a very large value for either the number of clients                   or the number of protocol ranges that will cause an integer overflow in                   the request length computation, defeating the check for request length.
    A client might send a request causing an integer overflow when computing                   the total size to allocate in RRChangeProviderProperty().

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-984e1cee93 advisory.

    xorg-x11-server CVE fix for CVE-2025-49175, CVE-2025-49176, CVE-2025-49177, CVE-2025-49178,     CVE-2025-49179, CVE-2025-49180

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-9304 advisory.

    - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135),                    CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147),                    CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159)

    Rebuild for 10.0.z required due to issue when releasing original erratum.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01981-1 advisory.

    - CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
    - CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
    - CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
    - CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
    - CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
    - CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01974-1 advisory.

    - CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
    - CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
    - CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
    - CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
    - CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
    - CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01975-1 advisory.

    - CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082)
    - CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084)
    - CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085)
    - CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087)
    - CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089)
    - CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01979-1 advisory.

    - CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
    - CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
    - CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
    - CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
    - CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
    - CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01980-1 advisory.

    - CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
    - CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
    - CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
    - CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
    - CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
    - CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e65a55c3d0 advisory.

    Update to xserver 21.1.18, contains an additional fix for CVE-2025-49176

    ----

    Update to xserver 21.1.17,     CVE fix for CVE-2025-49175, CVE-2025-49176, CVE-2025-49177,     CVE-2025-49178, CVE-2025-49179, CVE-2025-49180

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1fe27443e2 advisory.

    xorg-x11-server CVE fix for CVE-2025-49175, CVE-2025-49176, CVE-2025-49177, CVE-2025-49178,     CVE-2025-49179, CVE-2025-49180

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3fa66ac98b advisory.

    Update to xserver 21.1.18, contains an additional fix for CVE-2025-49176

    ----

    Update to xserver 21.1.17,     CVE fix for CVE-2025-49175, CVE-2025-49176, CVE-2025-49177,     CVE-2025-49178, CVE-2025-49179, CVE-2025-49180

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2363836c6c advisory.

    Update to xwayland 24.1.8, contains an additional fix for CVE-2025-49176

    ----

    Update to xserver 24.1.7,     CVE fix for CVE-2025-49175, CVE-2025-49176, CVE-2025-49177,     CVE-2025-49178, CVE-2025-49179, CVE-2025-49180

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5947 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5947-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 23, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : xorg-server     CVE ID         : CVE-2025-49175 CVE-2025-49176 CVE-2025-49177 CVE-2025-49178                      CVE-2025-49179 CVE-2025-49180

    Nils Emmerich discovered several vulnerabilities in the Xorg X server,     which may result in privilege escalation if the X server is running     privileged.

    For the stable distribution (bookworm), these problems have been fixed in     version 2:21.1.7-3+deb12u10.

    We recommend that you upgrade your xorg-server packages.

    For the detailed security status of xorg-server please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/xorg-server

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9304 advisory.

    Xwayland is an X server for running X clients under Wayland.

    Security Fix(es):

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's     XFixesSetClientDisconnectMode (CVE-2025-49177)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b4d521f084 advisory.

    Update to xserver 24.1.8, contains an additional fix for CVE-2025-49176

    ----

    Update to xserver 24.1.7,     CVE fix for CVE-2025-49175, CVE-2025-49176, CVE-2025-49177,     CVE-2025-49178, CVE-2025-49179, CVE-2025-49180

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7573-1 advisory.

    Nils Emmerich discovered that the X.Org X Server incorrectly handled certain memory operations. An     attacker could use these issues to cause the X Server to crash, leading to a denial of service, obtain     sensitive information, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241784	Amazon Linux 2023 : tigervnc, tigervnc-icons, tigervnc-license (ALAS2023-2025-1060)	Nessus	Amazon Linux Local Security Checks	high
241732	Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2025-1062)	Nessus	Amazon Linux Local Security Checks	high
241720	Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2025-1061)	Nessus	Amazon Linux Local Security Checks	high
241216	RHEL 9 : xorg-x11-server-Xwayland (RHSA-2025:10258)	Nessus	Red Hat Local Security Checks	high
241126	FreeBSD : xorg server -- Multiple vulnerabilities (b14cabf7-5663-11f0-943a-18c04d5ea3dc)	Nessus	FreeBSD Local Security Checks	medium
240894	Fedora 42 : tigervnc (2025-984e1cee93)	Nessus	Fedora Local Security Checks	medium
240860	Oracle Linux 10 : xorg-x11-server-Xwayland (ELSA-2025-9304)	Nessus	Oracle Linux Local Security Checks	medium
240829	SUSE SLED15 / SLES15 Security Update : xorg-x11-server (SUSE-SU-2025:01981-1)	Nessus	SuSE Local Security Checks	medium
240814	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xwayland (SUSE-SU-2025:01974-1)	Nessus	SuSE Local Security Checks	medium
240779	SUSE SLED15 / SLES15 Security Update : xwayland (SUSE-SU-2025:01975-1)	Nessus	SuSE Local Security Checks	medium
240775	SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2025:01979-1)	Nessus	SuSE Local Security Checks	medium
240755	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xorg-x11-server (SUSE-SU-2025:01980-1)	Nessus	SuSE Local Security Checks	medium
240708	Fedora 42 : xorg-x11-server (2025-e65a55c3d0)	Nessus	Fedora Local Security Checks	medium
240626	Fedora 41 : tigervnc (2025-1fe27443e2)	Nessus	Fedora Local Security Checks	medium
240512	Fedora 41 : xorg-x11-server (2025-3fa66ac98b)	Nessus	Fedora Local Security Checks	medium
240511	Fedora 41 : xorg-x11-server-Xwayland (2025-2363836c6c)	Nessus	Fedora Local Security Checks	medium
240282	Debian dsa-5947 : xnest - security update	Nessus	Debian Local Security Checks	medium
240255	RHEL 10 : xorg-x11-server-Xwayland (RHSA-2025:9304)	Nessus	Red Hat Local Security Checks	medium
240228	Fedora 42 : xorg-x11-server-Xwayland (2025-b4d521f084)	Nessus	Fedora Local Security Checks	medium
240160	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : X.Org X Server vulnerabilities (USN-7573-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-49177

medium

Tenable Plugins

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium