Summary
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080)
* xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081)
* xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | xorg-x11-server-Xwayland | 21.1.3-16.el8_10 |
Vulnerabilities 3
-
High 7.8
Xorg-x11-server: use-after-free in procrenderaddglyphs
A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the …
-
High 7.3
Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly …
-
High 7.3
Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly …
References
-
report
https://access.redhat.com/security/cve/CVE-2024-31080
-
report
https://access.redhat.com/security/cve/CVE-2024-31081
-
report
https://access.redhat.com/security/cve/CVE-2024-31083
-
report
https://bugzilla.redhat.com/2271997
-
report
https://bugzilla.redhat.com/2271998
-
report
https://bugzilla.redhat.com/2272000
-
advisory
https://errata.almalinux.org/8/ALSA-2024-3343.html