BSD Portsxorg server -- Multiple vulnerabilities
· CVE-2025-49176 · VuXML entry
The X.Org project reports: CVE-2025-49176: Integer overflow in Big Requests Extension The Big Requests extension allows requests larger than the 16-bit length limit. It uses integers for the request length and checks for the size not to exceed the maxBigRequestSize limit, but does so after translating the length to integer by multiplying the given size in bytes by 4. In doing so, it might overflow the integer size …
Affected versions
- xorg-server, xephyr, xorg-vfbserver < 21.1.18,1
- xorg-nextserver < 21.1.18,2
- xwayland < 24.1.8,1
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | x11-servers/xorg-server | 21.1.16,1 | vulnerable since 2025-07-01 | |
| MidnightBSD | x11-servers/xorg-server | 21.1.25,1 | out of range, by version | |
| FreeBSD | x11-servers/xorg-server | 21.1.25,1 | fixed | (372 days after) |
| DragonFly | x11-servers/xwayland | 24.1.6,1 | vulnerable since 2025-07-01 | |
| OpenBSD | wayland/xwayland | 24.1.14 | out of range, by version | |
| MidnightBSD | x11-servers/xwayland | 24.1.14,1 | out of range, by version | |
| FreeBSD | x11-servers/xwayland | 24.1.14,1 | fixed | (372 days after) |