The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9304 advisory.

    Xwayland is an X server for running X clients under Wayland.

    Security Fix(es):

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's     XFixesSetClientDisconnectMode (CVE-2025-49177)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1062 advisory.

    A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no     cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
    (CVE-2025-49175)

    A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking     against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
    (CVE-2025-49176)

    A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the     request length, allowing a client to read unintended memory from previous requests. (CVE-2025-49177)

    A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can     cause the server to skip processing another client's request, potentially leading to a denial of service.
    (CVE-2025-49178)

    The RecordSanityCheckRegisterClients() function in the X Record extension implementation of the Xserver     checks for the request length, but does not check for integer overflow.

    A client might send a very large value for either the number of clients or the number of protocol ranges     that will cause an integer overflow in the request length computation, defeating the check for request     length. (CVE-2025-49179)

    A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly     validate input. This issue leads to an integer overflow when computing the total size to allocate.
    (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of xorg-x11-server / xorg-x11-server-Xwayland installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-49179 advisory.

  - A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check     for an integer overflow when computing request length, which allows a client to bypass length checks.
    (CVE-2025-49179)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10563:07 advisory.

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:9304 advisory.

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's     XFixesSetClientDisconnectMode (CVE-2025-49177)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:9304 advisory.

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's     XFixesSetClientDisconnectMode (CVE-2025-49177)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)
      * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ55695. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ55695 advisory.

  - A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check     for an integer overflow when computing request length, which allows a client to bypass length checks.
    (CVE-2025-49179)

  - A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no     cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
    (CVE-2025-49175)

  - A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking     against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
    (CVE-2025-49176)

  - A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can     cause the server to skip processing another client's request, potentially leading to a denial of service.
    (CVE-2025-49178)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:9306 advisory.

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension     Animated Cursors (CVE-2025-49175)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension     (CVE-2025-49176)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore     (CVE-2025-49178)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension     (CVE-2025-49179)

    * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect     (RandR) Extension (CVE-2025-49180)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
240255	RHEL 10 : xorg-x11-server-Xwayland (RHSA-2025:9304)	Nessus	Red Hat Local Security Checks	2025/6/23	2026/1/21	high
241732	Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2025-1062)	Nessus	Amazon Linux Local Security Checks	2025/7/10	2025/7/14	high
244802	Azure Linux 3.0 Security Update: xorg-x11-server / xorg-x11-server-Xwayland (CVE-2025-49179)	Nessus	Azure Linux Local Security Checks	2025/8/7	2025/9/15	high
283214	MiracleLinux 9 : tigervnc-1.14.1-8.el9_6 (AXSA:2025-10563:07)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
269747	RockyLinux 10 : xorg-x11-server-Xwayland (RLSA-2025:9304)	Nessus	Rocky Linux Local Security Checks	2025/10/8	2025/10/8	high
269839	AlmaLinux 10 : xorg-x11-server-Xwayland (ALSA-2025:9304)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	high
270141	AIX : Multiple Vulnerabilities (IJ55695)	Nessus	AIX Local Security Checks	2025/10/13	2025/10/13	high
266715	RockyLinux 9 : tigervnc (RLSA-2025:9306)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	high

检测

插件搜索

high

high

high

high

high

high

high

high