cbcvebase.
CVE-2025-49177
published 2025-06-17

CVE-2025-49177: A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended…

medium6.1CVSS 3.1
AVLACLPRLUINSUCHINAL
A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Affected

12 ranges
VendorProductVersion rangeFixed in
debianxorg-server< xorg-server 2:21.1.7-3+deb12u10 (bookworm)xorg-server 2:21.1.7-3+deb12u10 (bookworm)
debianxwayland< xorg-server 2:21.1.7-3+deb12u10 (bookworm)xorg-server 2:21.1.7-3+deb12u10 (bookworm)
msrcazl3_wayland_1.22.0-1_on_azure_linux_3.0
msrcazl3_xorg-x11-server-xwayland_24.1.6-2_on_azure_linux_3.0
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0
x.orgxorg-server>= 0 < 2:21.1.7-3+deb12u102:21.1.7-3+deb12u10
x.orgxorg-server>= 0 < 2:21.1.16-1.22:21.1.16-1.2
x.orgxorg-server>= 0 < 2:21.1.16-1.22:21.1.16-1.2
x.orgxwayland< 24.1.724.1.7
x.orgxwayland>= 0 < 2:24.1.8-12:24.1.8-1

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
osv6.1MEDIUM