Red Hat Product Security has issued an important security advisory (RHSA-2025:10377) for tigervnc in Red Hat Enterprise Linux 6 Extended Lifecycle Support. The advisory addresses five vulnerabilities: CVE-2025-49175 (Out-of-Bounds Read in X Rendering Extension Animated Cursors), CVE-2025-49176 (Integer Overflow in Big Requests Extension), CVE-2025-49178 (Unprocessed Client Request Due to Bytes to Ignore), CVE-2025-49179 (Integer Overflow in X Record extension), and CVE-2025-49180 (Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension). These issues affect the xorg-x11-server-Xwayland component and tigervnc suite, potentially impacting the remote display system functionality. The advisory includes updated tigervnc packages to fix these vulnerabilities.

The vulnerabilities involve memory safety issues such as out-of-bounds reads and integer overflows in the tigervnc implementation of various X11 extensions. These could lead to crashes or potentially allow an attacker to cause denial of service or other unintended behavior when processing specially crafted requests. The advisory rates the impact as Important, indicating a high severity but no confirmed exploits in the wild at the time of publication.

Red Hat has released updated tigervnc packages for Red Hat Enterprise Linux 6 Extended Lifecycle Support to address these vulnerabilities. Users should apply the security update RHSA-2025:10377 promptly by following the instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.