Red Hat Product Security issued an important security advisory (RHSA-2025:10360) for xorg-x11-server in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The advisory addresses five vulnerabilities (CVE-2025-49175, CVE-2025-49176, CVE-2025-49178, CVE-2025-49179, CVE-2025-49180) involving out-of-bounds reads and integer overflows in tigervnc components of xorg-x11-server-Xwayland. These vulnerabilities affect various X.Org extensions including the X Rendering Extension Animated Cursors, Big Requests Extension, X Record extension, and RandR extension. The advisory provides updated packages to remediate these issues. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. The advisory includes detailed package versions and instructions for applying the update.

The vulnerabilities could allow an attacker to cause out-of-bounds reads or integer overflows within the X.Org server components, potentially leading to denial of service or other unintended behavior. The issues affect the tigervnc implementation in xorg-x11-server-Xwayland and involve critical X.Org extensions. The advisory does not specify exploitation in the wild or detailed impact scenarios but rates the security impact as Important.

Red Hat has released an official security update for xorg-x11-server in Red Hat Enterprise Linux 7 Extended Lifecycle Support that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2025:10360 and the referenced article https://access.redhat.com/articles/11258. The update includes fixed packages for multiple architectures. No additional mitigation steps are indicated beyond applying the official patch.