CVE-2025-49177

Name
CVE-2025-49177
Description
A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2025-49177
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2369955
vendor-advisory https://access.redhat.com/errata/RHSA-2025:9304
secalert@redhat.com https://access.redhat.com/errata/RHSA-2025:10258
secalert@redhat.com https://access.redhat.com/errata/RHSA-2025:9303
secalert@redhat.com https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab02fb96b1c701c3bb47617d965522c34befa6af
secalert@redhat.com https://www.x.org/wiki/Development/Security/

Match rules

CPE URI Source package Min version Max version
cpe:/o:redhat:enterprise_linux:10.0 shopxo >= 0:24.1.5-4.el10_0 < *

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
xwayland edge-community 24.1.7-r0 Simon Zeni <simon@bl4ckb0ne.ca> fixed
xwayland 3.22-community 24.1.7-r0 None fixed
xorg-server edge-community 21.1.17-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xorg-server 3.22-community 21.1.17-r0 None fixed