Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-49177

Опубликовано: 17 июн. 2025
Источник: redhat
CVSS3: 6.1
EPSS Низкий

Описание

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Отчет

This vulnerability is rated as an important severity because the flaw exists in the XFIXES extension, specifically in the XFixesSetClientDisconnectMode handler. The handler does not validate the request length field correctly, allowing a client to read beyond the intended bounds of the input buffer. This flaw can result in disclosure of uninitialized memory contents from prior operations, potentially exposing sensitive information from other clients or internal server state. While this issue primarily affects confidentiality, it may also impact availability if the invalid read leads to a crash.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6tigervncWill not fix
Red Hat Enterprise Linux 6xorg-x11-serverWill not fix
Red Hat Enterprise Linux 7tigervncWill not fix
Red Hat Enterprise Linux 7xorg-x11-serverWill not fix
Red Hat Enterprise Linux 8tigervncWill not fix
Red Hat Enterprise Linux 8xorg-x11-serverWill not fix
Red Hat Enterprise Linux 8xorg-x11-server-XwaylandWill not fix
Red Hat Enterprise Linux 9tigervncWill not fix
Red Hat Enterprise Linux 9xorg-x11-serverNot affected
Red Hat Enterprise Linux 9xorg-x11-server-XwaylandAffected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-200
https://bugzilla.redhat.com/show_bug.cgi?id=2369955xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode

EPSS

Процентиль: 4%
0.0002
Низкий

6.1 Medium

CVSS3

Связанные уязвимости

CVSS3: 6.1
ubuntu
около 2 месяцев назад

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

CVSS3: 6.1
nvd
около 2 месяцев назад

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

CVSS3: 6.1
debian
около 2 месяцев назад

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnec ...

CVSS3: 5.5
github
около 2 месяцев назад

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

suse-cvrf
около 2 месяцев назад

Security update for xorg-x11-server

EPSS

Процентиль: 4%
0.0002
Низкий

6.1 Medium

CVSS3