xorg-server-21.1.17

[zeckma]

New patch release. This release fixes 6 security vulnerabilities.

• CVE-2025-49175: This vulnerability introduced in X11R6.7 allows for a client to provide no cursor to the Xserver which causes an out of bounds read and crashes the server via the X Rendering Extension.
• CVE-2025-49176: This vulnerability introduced in X11R6.0 allows for integer overflow before testing for said overflow in the Big Requests Extension.
• CVE-2025-49177: This vulnerability introduced in Xorg-Server-21.0.99.1/Xwayland-22.0.99.1 allows for a client sending shorter requests and thus read old data via the XFIXES Extension 6.
• CVE-2025-49178: This vulnerability introduced in Xorg-1.10.0 allows for an input buffer to be shared between clients, causing one of the clients to hang due to bytes being ignored may be non-zero despite having a full request.
• CVE-2025-49179: This vulnerability introduced in X11R6.1 allows for an integer overflow in the X Record Extension.
• CVE-2025-49180: This vulnerability introduced in Xorg-Server-1.12.99.901 allows for an integer overflow in the RandR Extension.

These vulnerabilities are shared with Xwayland and all of them are rated MEDIUM.

[zeckma]

Fixed at 74fb7f399ac6fa2f3fd567f5eca287b4b71ba290.