{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-31083"
      ],
      "details": "A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.",
      "id": "GSD-2024-31083",
      "modified": "2024-04-03T05:02:25.570729Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2024-31083",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Red Hat Enterprise Linux 7",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.20.4-29.el7_9",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected"
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.13.1-2.el8_9.10",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected"
                          }
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected"
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.9.0-15.el8_2.11",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.9.0-15.el8_2.11",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.9.0-15.el8_2.11",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.11.0-8.el8_4.10",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.11.0-8.el8_4.10",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.11.0-8.el8_4.10",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.12.0-6.el8_6.11",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.12.0-15.el8_8.10",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.11.0-22.el9_0.11",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "0:1.12.0-14.el9_2.8",
                                "versionType": "rpm"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 6",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unknown"
                          }
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unknown"
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Red Hat Enterprise Linux 9",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected"
                          }
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected"
                          }
                        },
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected"
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Red Hat"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-416",
                "lang": "eng",
                "value": "Use After Free"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:1785",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:1785"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2036",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2036"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2037",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2037"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2038",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2038"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2039",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2039"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2040",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2040"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2041",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2041"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2024:2042",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2024:2042"
          },
          {
            "name": "https://access.redhat.com/security/cve/CVE-2024-31083",
            "refsource": "MISC",
            "url": "https://access.redhat.com/security/cve/CVE-2024-31083"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2272000",
            "refsource": "MISC",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272000"
          },
          {
            "name": "https://lists.debian.org/debian-lts-announce/2024/04/msg00009.html",
            "refsource": "MISC",
            "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00009.html"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6TF7FZXOKHIKPZXYIMSQXKVH7WITKV3V/",
            "refsource": "MISC",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6TF7FZXOKHIKPZXYIMSQXKVH7WITKV3V/"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EBLQJIAXEDMEGRGZMSH7CWUJHSVKUWLV/",
            "refsource": "MISC",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EBLQJIAXEDMEGRGZMSH7CWUJHSVKUWLV/"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P73U4DAAWLFZAPD75GLXTGMSTTQWW5AP/",
            "refsource": "MISC",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P73U4DAAWLFZAPD75GLXTGMSTTQWW5AP/"
          }
        ]
      },
      "work_around": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 una vulnerabilidad de use-after-free en la funci\u00f3n ProcRenderAddGlyphs() de los servidores Xorg. Este problema ocurre cuando se llama a AllocateGlyph() para almacenar nuevos glifos enviados por el cliente al servidor X, lo que potencialmente resulta en m\u00faltiples entradas que apuntan a los mismos glifos no recontados. En consecuencia, ProcRenderAddGlyphs() puede liberar un glifo, lo que lleva a un escenario de use-after-free cuando posteriormente se accede al mismo puntero de glifo. Esta falla permite que un atacante autenticado ejecute c\u00f3digo arbitrario en el sistema enviando una solicitud especialmente manipulada."
          }
        ],
        "id": "CVE-2024-31083",
        "lastModified": "2024-04-25T18:15:08.470",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-05T12:15:37.577",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:1785"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2036"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2037"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2038"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2039"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2040"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2041"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:2042"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2024-31083"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272000"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00009.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6TF7FZXOKHIKPZXYIMSQXKVH7WITKV3V/"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EBLQJIAXEDMEGRGZMSH7CWUJHSVKUWLV/"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P73U4DAAWLFZAPD75GLXTGMSTTQWW5AP/"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-31083 Xorg-x11-server: use-after-free in procrenderaddglyphs - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-31083.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Xorg-x11-server: use-after-free in procrenderaddglyphs",
    "tracking": {
      "current_release_date": "2026-02-18T14:59:18.000Z",
      "generator": {
        "date": "2026-02-20T23:42:45.236Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-31083",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-08-18T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2024-10-05T00:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2024-12-03T00:00:00.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added xorg-x11-server to CBL-Mariner 2.0"
        },
        {
          "date": "2026-02-18T14:59:18.000Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 xorg-x11-server 1.20.10-11",
                "product": {
                  "name": "\u003ccbl2 xorg-x11-server 1.20.10-11",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 xorg-x11-server 1.20.10-11",
                "product": {
                  "name": "cbl2 xorg-x11-server 1.20.10-11",
                  "product_id": "17370"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 xorg-x11-server 1.20.10-15",
                "product": {
                  "name": "\u003ccbl2 xorg-x11-server 1.20.10-15",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 xorg-x11-server 1.20.10-15",
                "product": {
                  "name": "cbl2 xorg-x11-server 1.20.10-15",
                  "product_id": "19982"
                }
              }
            ],
            "category": "product_name",
            "name": "xorg-x11-server"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 xorg-x11-server 1.20.10-11 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 xorg-x11-server 1.20.10-11 as a component of CBL Mariner 2.0",
          "product_id": "17370-17086"
        },
        "product_reference": "17370",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 xorg-x11-server 1.20.10-15 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 xorg-x11-server 1.20.10-15 as a component of CBL Mariner 2.0",
          "product_id": "19982-17086"
        },
        "product_reference": "19982",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31083",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "general",
          "text": "redhat",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17370-17086",
          "19982-17086"
        ],
        "known_affected": [
          "17086-2",
          "17086-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-31083 Xorg-x11-server: use-after-free in procrenderaddglyphs - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-31083.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-08-18T00:00:00.000Z",
          "details": "1.20.10-11:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-2",
            "17086-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "17086-2",
            "17086-1"
          ]
        }
      ],
      "title": "Xorg-x11-server: use-after-free in procrenderaddglyphs"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "xorg-x11-server-21.1.12-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the xorg-x11-server-21.1.12-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13828",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13828-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31080 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31080/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31081 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31081/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31082 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31082/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31083 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31083/"
      }
    ],
    "title": "xorg-x11-server-21.1.12-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13828-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-21.1.12-1.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-21.1.12-1.1.aarch64",
                  "product_id": "xorg-x11-server-21.1.12-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
                  "product_id": "xorg-x11-server-Xvfb-21.1.12-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-21.1.12-1.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-extra-21.1.12-1.1.aarch64",
                  "product_id": "xorg-x11-server-extra-21.1.12-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-21.1.12-1.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-sdk-21.1.12-1.1.aarch64",
                  "product_id": "xorg-x11-server-sdk-21.1.12-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-21.1.12-1.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-source-21.1.12-1.1.aarch64",
                  "product_id": "xorg-x11-server-source-21.1.12-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
                  "product_id": "xorg-x11-server-wrapper-21.1.12-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-21.1.12-1.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-21.1.12-1.1.ppc64le",
                  "product_id": "xorg-x11-server-21.1.12-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
                  "product_id": "xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-21.1.12-1.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-extra-21.1.12-1.1.ppc64le",
                  "product_id": "xorg-x11-server-extra-21.1.12-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
                  "product_id": "xorg-x11-server-sdk-21.1.12-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-21.1.12-1.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-source-21.1.12-1.1.ppc64le",
                  "product_id": "xorg-x11-server-source-21.1.12-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
                  "product_id": "xorg-x11-server-wrapper-21.1.12-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-21.1.12-1.1.s390x",
                "product": {
                  "name": "xorg-x11-server-21.1.12-1.1.s390x",
                  "product_id": "xorg-x11-server-21.1.12-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
                "product": {
                  "name": "xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
                  "product_id": "xorg-x11-server-Xvfb-21.1.12-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-21.1.12-1.1.s390x",
                "product": {
                  "name": "xorg-x11-server-extra-21.1.12-1.1.s390x",
                  "product_id": "xorg-x11-server-extra-21.1.12-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-21.1.12-1.1.s390x",
                "product": {
                  "name": "xorg-x11-server-sdk-21.1.12-1.1.s390x",
                  "product_id": "xorg-x11-server-sdk-21.1.12-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-21.1.12-1.1.s390x",
                "product": {
                  "name": "xorg-x11-server-source-21.1.12-1.1.s390x",
                  "product_id": "xorg-x11-server-source-21.1.12-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-wrapper-21.1.12-1.1.s390x",
                "product": {
                  "name": "xorg-x11-server-wrapper-21.1.12-1.1.s390x",
                  "product_id": "xorg-x11-server-wrapper-21.1.12-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-21.1.12-1.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-21.1.12-1.1.x86_64",
                  "product_id": "xorg-x11-server-21.1.12-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
                  "product_id": "xorg-x11-server-Xvfb-21.1.12-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-21.1.12-1.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-extra-21.1.12-1.1.x86_64",
                  "product_id": "xorg-x11-server-extra-21.1.12-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-21.1.12-1.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-sdk-21.1.12-1.1.x86_64",
                  "product_id": "xorg-x11-server-sdk-21.1.12-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-21.1.12-1.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-source-21.1.12-1.1.x86_64",
                  "product_id": "xorg-x11-server-source-21.1.12-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-wrapper-21.1.12-1.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-wrapper-21.1.12-1.1.x86_64",
                  "product_id": "xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-21.1.12-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64"
        },
        "product_reference": "xorg-x11-server-21.1.12-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-21.1.12-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-21.1.12-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-21.1.12-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x"
        },
        "product_reference": "xorg-x11-server-21.1.12-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-21.1.12-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64"
        },
        "product_reference": "xorg-x11-server-21.1.12-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xvfb-21.1.12-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64"
        },
        "product_reference": "xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xvfb-21.1.12-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x"
        },
        "product_reference": "xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xvfb-21.1.12-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64"
        },
        "product_reference": "xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-21.1.12-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64"
        },
        "product_reference": "xorg-x11-server-extra-21.1.12-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-21.1.12-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-extra-21.1.12-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-21.1.12-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x"
        },
        "product_reference": "xorg-x11-server-extra-21.1.12-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-21.1.12-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64"
        },
        "product_reference": "xorg-x11-server-extra-21.1.12-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-21.1.12-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64"
        },
        "product_reference": "xorg-x11-server-sdk-21.1.12-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-21.1.12-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-21.1.12-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x"
        },
        "product_reference": "xorg-x11-server-sdk-21.1.12-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-21.1.12-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64"
        },
        "product_reference": "xorg-x11-server-sdk-21.1.12-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-source-21.1.12-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64"
        },
        "product_reference": "xorg-x11-server-source-21.1.12-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-source-21.1.12-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-source-21.1.12-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-source-21.1.12-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x"
        },
        "product_reference": "xorg-x11-server-source-21.1.12-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-source-21.1.12-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64"
        },
        "product_reference": "xorg-x11-server-source-21.1.12-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-wrapper-21.1.12-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64"
        },
        "product_reference": "xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-wrapper-21.1.12-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-wrapper-21.1.12-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x"
        },
        "product_reference": "xorg-x11-server-wrapper-21.1.12-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-wrapper-21.1.12-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
        },
        "product_reference": "xorg-x11-server-wrapper-21.1.12-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31080",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31080"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer over-read vulnerability was found in the X.org server\u0027s ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0027s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31080",
          "url": "https://www.suse.com/security/cve/CVE-2024-31080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222309 for CVE-2024-31080",
          "url": "https://bugzilla.suse.com/1222309"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31080",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31080"
    },
    {
      "cve": "CVE-2024-31081",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31081"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer over-read vulnerability was found in the X.org server\u0027s ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0027s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31081",
          "url": "https://www.suse.com/security/cve/CVE-2024-31081"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222310 for CVE-2024-31081",
          "url": "https://bugzilla.suse.com/1222310"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31081",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31081"
    },
    {
      "cve": "CVE-2024-31082",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31082"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer over-read vulnerability was found in the X.org server\u0027s ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0027s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31082",
          "url": "https://www.suse.com/security/cve/CVE-2024-31082"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222311 for CVE-2024-31082",
          "url": "https://bugzilla.suse.com/1222311"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31082",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31082"
    },
    {
      "cve": "CVE-2024-31083",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31083"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
          "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31083",
          "url": "https://www.suse.com/security/cve/CVE-2024-31083"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31083",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-Xvfb-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-extra-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-sdk-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-source-21.1.12-1.1.x86_64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.aarch64",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.ppc64le",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.s390x",
            "openSUSE Tumbleweed:xorg-x11-server-wrapper-21.1.12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31083"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "xwayland-23.2.5-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the xwayland-23.2.5-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13829",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13829-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31080 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31080/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31081 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31081/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-31083 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-31083/"
      }
    ],
    "title": "xwayland-23.2.5-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13829-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xwayland-23.2.5-1.1.aarch64",
                "product": {
                  "name": "xwayland-23.2.5-1.1.aarch64",
                  "product_id": "xwayland-23.2.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xwayland-devel-23.2.5-1.1.aarch64",
                "product": {
                  "name": "xwayland-devel-23.2.5-1.1.aarch64",
                  "product_id": "xwayland-devel-23.2.5-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xwayland-23.2.5-1.1.ppc64le",
                "product": {
                  "name": "xwayland-23.2.5-1.1.ppc64le",
                  "product_id": "xwayland-23.2.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xwayland-devel-23.2.5-1.1.ppc64le",
                "product": {
                  "name": "xwayland-devel-23.2.5-1.1.ppc64le",
                  "product_id": "xwayland-devel-23.2.5-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xwayland-23.2.5-1.1.s390x",
                "product": {
                  "name": "xwayland-23.2.5-1.1.s390x",
                  "product_id": "xwayland-23.2.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xwayland-devel-23.2.5-1.1.s390x",
                "product": {
                  "name": "xwayland-devel-23.2.5-1.1.s390x",
                  "product_id": "xwayland-devel-23.2.5-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xwayland-23.2.5-1.1.x86_64",
                "product": {
                  "name": "xwayland-23.2.5-1.1.x86_64",
                  "product_id": "xwayland-23.2.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xwayland-devel-23.2.5-1.1.x86_64",
                "product": {
                  "name": "xwayland-devel-23.2.5-1.1.x86_64",
                  "product_id": "xwayland-devel-23.2.5-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-23.2.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64"
        },
        "product_reference": "xwayland-23.2.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-23.2.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le"
        },
        "product_reference": "xwayland-23.2.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-23.2.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x"
        },
        "product_reference": "xwayland-23.2.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-23.2.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64"
        },
        "product_reference": "xwayland-23.2.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-devel-23.2.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64"
        },
        "product_reference": "xwayland-devel-23.2.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-devel-23.2.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le"
        },
        "product_reference": "xwayland-devel-23.2.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-devel-23.2.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x"
        },
        "product_reference": "xwayland-devel-23.2.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xwayland-devel-23.2.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
        },
        "product_reference": "xwayland-devel-23.2.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31080",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31080"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer over-read vulnerability was found in the X.org server\u0027s ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0027s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31080",
          "url": "https://www.suse.com/security/cve/CVE-2024-31080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222309 for CVE-2024-31080",
          "url": "https://bugzilla.suse.com/1222309"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31080",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31080"
    },
    {
      "cve": "CVE-2024-31081",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31081"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer over-read vulnerability was found in the X.org server\u0027s ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0027s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31081",
          "url": "https://www.suse.com/security/cve/CVE-2024-31081"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222310 for CVE-2024-31081",
          "url": "https://bugzilla.suse.com/1222310"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31081",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31081"
    },
    {
      "cve": "CVE-2024-31083",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-31083"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
          "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
          "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-31083",
          "url": "https://www.suse.com/security/cve/CVE-2024-31083"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222312 for CVE-2024-31083",
          "url": "https://bugzilla.suse.com/1222312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-23.2.5-1.1.x86_64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.aarch64",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.ppc64le",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.s390x",
            "openSUSE Tumbleweed:xwayland-devel-23.2.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-31083"
    }
  ]
}