CVE-2025-49178
published 2025-06-17CVE-2025-49178: A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.8th percentile
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xorg-server | < xorg-server 2:21.1.7-3+deb12u10 (bookworm) | xorg-server 2:21.1.7-3+deb12u10 (bookworm) |
| debian | xwayland | < xorg-server 2:21.1.7-3+deb12u10 (bookworm) | xorg-server 2:21.1.7-3+deb12u10 (bookworm) |
| msrc | azl3_wayland_1.22.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_xorg-x11-server-xwayland_24.1.6-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_xorg-x11-server_1.20.10-16_on_cbl_mariner_2.0 | — | — |
| x.org | xorg-server | >= 0 < 2:1.20.11-1+deb11u16 | 2:1.20.11-1+deb11u16 |
| x.org | xorg-server | >= 0 < 2:21.1.7-3+deb12u10 | 2:21.1.7-3+deb12u10 |
| x.org | xorg-server | >= 0 < 2:21.1.16-1.2 | 2:21.1.16-1.2 |
| x.org | xorg-server | >= 0 < 2:21.1.16-1.2 | 2:21.1.16-1.2 |
| x.org | xwayland | < 24.1.7 | 24.1.7 |
| x.org | xwayland | >= 0 < 2:24.1.8-1 | 2:24.1.8-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
X.Org X Server vulnerabilities
vendor_ubuntu·2025-06-18
CVE-2025-49179 X.Org X Server vulnerabilities
Title: X.Org X Server vulnerabilities
Summary: Several security issues were fixed in X.Org X Server.
USN-7573-1 fixed several vulnerabilities in X.Org. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu
20.04 LTS.
Original advisory details:
Nils Emmerich discovered that the X.Org X Server incorrectly handled
certain memory operations. An attacker could use these issues to cause the
X Server to crash, leading to a denial of service, obtain sensitive
information, or possibly execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Ubuntu
X.Org X Server vulnerabilities
vendor_ubuntu·2025-06-17
CVE-2025-49176 X.Org X Server vulnerabilities
Title: X.Org X Server vulnerabilities
Summary: Several security issues were fixed in X.Org X Server.
Nils Emmerich discovered that the X.Org X Server incorrectly handled
certain memory operations. An attacker could use these issues to cause the
X Server to crash, leading to a denial of service, obtain sensitive
information, or possibly execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Red Hat
xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore
vendor_redhat·2025-06-17·CVSS 5.5
CVE-2025-49178 [MEDIUM] CWE-667 xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore
xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
Statement: This vulnerability is rated as a moderate severity because the flaw exists in the X server’s request handling logic, where the “bytes to ignore” field in a client request is not properly validated. A malicious client can submit a request specifying a non-zero
Microsoft
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
vendor_msrc·2025-06-10·CVSS 5.5
CVE-2025-49178 [MEDIUM] CWE-667 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediatio
Microsoft
memstick/mspro_block: fix handling of read-only devices
vendor_msrc·2025-02-11·CVSS 5.5
CVE-2022-49178 [MEDIUM] CWE-401 memstick/mspro_block: fix handling of read-only devices
memstick/mspro_block: fix handling of read-only devices
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2025-49178: xorg-server - A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' ...
vendor_debian·2025·CVSS 5.5
CVE-2025-49178 [MEDIUM] CVE-2025-49178: xorg-server - A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' ...
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
Scope: local
bookworm: resolved (fixed in 2:21.1.7-3+deb12u10)
bullseye: resolved (fixed in 2:1.20.11-1+deb11u16)
forky: resolved (fixed in 2:21.1.16-1.2)
sid: resolved (fixed in 2:21.1.16-1.2)
trixie: resolved (fixed in 2:21.1.16-1.2)
GHSA
GHSA-69rm-w9qj-3x45: A flaw was found in the X server's request handling
ghsa_unreviewed·2025-06-17
CVE-2025-49178 [MEDIUM] CWE-667 GHSA-69rm-w9qj-3x45: A flaw was found in the X server's request handling
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
OSV
CVE-2025-49178: A flaw was found in the X server's request handling
osv·2025-06-17·CVSS 5.5
CVE-2025-49178 [MEDIUM] CVE-2025-49178: A flaw was found in the X server's request handling
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2025:10258https://access.redhat.com/errata/RHSA-2025:10342https://access.redhat.com/errata/RHSA-2025:10343https://access.redhat.com/errata/RHSA-2025:10344https://access.redhat.com/errata/RHSA-2025:10346https://access.redhat.com/errata/RHSA-2025:10347https://access.redhat.com/errata/RHSA-2025:10348https://access.redhat.com/errata/RHSA-2025:10349https://access.redhat.com/errata/RHSA-2025:10350https://access.redhat.com/errata/RHSA-2025:10351https://access.redhat.com/errata/RHSA-2025:10352https://access.redhat.com/errata/RHSA-2025:10355https://access.redhat.com/errata/RHSA-2025:10356https://access.redhat.com/errata/RHSA-2025:10360https://access.redhat.com/errata/RHSA-2025:10370https://access.redhat.com/errata/RHSA-2025:10374https://access.redhat.com/errata/RHSA-2025:10375https://access.redhat.com/errata/RHSA-2025:10376https://access.redhat.com/errata/RHSA-2025:10377https://access.redhat.com/errata/RHSA-2025:10378https://access.redhat.com/errata/RHSA-2025:10381https://access.redhat.com/errata/RHSA-2025:10410https://access.redhat.com/errata/RHSA-2025:9303https://access.redhat.com/errata/RHSA-2025:9304https://access.redhat.com/errata/RHSA-2025:9305https://access.redhat.com/errata/RHSA-2025:9306https://access.redhat.com/errata/RHSA-2025:9392https://access.redhat.com/errata/RHSA-2025:9964https://access.redhat.com/security/cve/CVE-2025-49178https://bugzilla.redhat.com/show_bug.cgi?id=2369977https://gitlab.freedesktop.org/xorg/xserver/-/commit/d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2https://www.x.org/wiki/Development/Security/https://lists.debian.org/debian-lts-announce/2025/06/msg00028.html
2025-06-17
Published