Back Linuxsecurity

Fedora 42: fvwm3 Critical CVE-2025

Linuxsecurity •LinuxSecurity Advisories • November 18, 2025

Fvwm is a window manager for X11. It is designed to minimize memory consumption, provide a 3D look to window frames, and implement a virtual desktop. Update Information : FVWM3 ver. 1.1.4

Fvwm is a window manager for X11. It is designed to minimize memory

consumption, provide a 3D look to window frames, and implement a virtual

* Sun Nov 9 2025 Peter Lemenkov - 1.1.4-1 - FVWM3 ver. 1.1.4 * Fri Oct 10 2025 Maxwell G - 1.1.3-6 - Rebuild for golang 1.25.2 * Fri Aug 15 2025 Maxwell G - 1.1.3-5 - Rebuild for golang-1.25.0 * Fri Aug 15 2025 Maxwell G - 1.1.3-4 - Revert "Rebuild for golang-1.25.0" * Fri Aug 15 2025 Maxwell G - 1.1.3-3 - Rebuild for golang-1.25.0 * Wed Jul 23 2025 Fedora Release Engineering - 1.1.3-2 - Rebuilt for

[ 1 ] Bug #2399091 - CVE-2025-47906 fvwm3: Unexpected paths returned from LookPath in os/exec [fedora-41] [ 2 ] Bug #2399366 - CVE-2025-47906 fvwm3: Unexpected paths returned from LookPath in os/exec [fedora-42] [ 3 ] Bug #2413611 - fvwm3-1.1.4 is available

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-f7d7958683' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FVWM3 Vulnerability Across Fedora Versions CVE-2025 A critical command injection vulnerability has been identified in FVWM3, a window manager for X11, affecting Fedora versions 41, 42, and 43. The vulnerability has been addressed with an update to FVWM3 version 1.1.4, released on November 9, 2025. Users are advised to update their systems to mitigate potential risks associated with this security flaw. 3 sources 34

Extracted Entities

CVEs (1)

CVE-2025-47906

Platforms (2)

Fvwm3 X11