{"id":"CVE-2024-31082","aliases":["ALPINE-CVE-2024-31082","AZL-39112","AZL-45393","BELL-CVE-2024-31082","DEBIAN-CVE-2024-31082","EUVD-2024-28993","GHSA-cm2m-f7gc-hv64","OESA-2024-1416","SUSE-SU-2024:1199-1","SUSE-SU-2024:1260-1","SUSE-SU-2024:1261-1","SUSE-SU-2024:1262-1","UBUNTU-CVE-2024-31082","USN-6721-1","openSUSE-SU-2024:13828-1"],"status":"published","title":"Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00338,"percentile":0.27483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-126"],"published":"2024-03-04T00:00:00Z","modified":"2026-11-05T21:15:46Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"xorg-x11-server","fixed_in":["1.20.10-11"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:21.1.7-3+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:21.1.11-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:21.1.11-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","fixed_in":["2:1.15.1-0ubuntu2.11+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","fixed_in":["2:1.18.4-0ubuntu0.12+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","fixed_in":["2:1.19.6-1ubuntu4.15+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"xorg-server","fixed_in":["2:1.20.13-1ubuntu1~20.04.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","fixed_in":["2:21.1.4-2ubuntu1.7~22.04.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","fixed_in":["2:22.1.1-1ubuntu0.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","fixed_in":["2:21.1.12-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.10-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.10-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u7"}]}],"versions":["2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.11-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.11-3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.8-24.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.8-26.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-29.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-29.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-29.oe2203sp2"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-29.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.71.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.71.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.71.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.48.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.48.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.48.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.48.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.48.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.48.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.96.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.11+esm11"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10","2:1.15.1-0ubuntu2.11","2:1.15.1-0ubuntu2.11+esm2","2:1.15.1-0ubuntu2.11+esm3","2:1.15.1-0ubuntu2.11+esm4","2:1.15.1-0ubuntu2.11+esm5","2:1.15.1-0ubuntu2.11+esm6","2:1.15.1-0ubuntu2.11+esm7","2:1.15.1-0ubuntu2.11+esm8","2:1.15.1-0ubuntu2.11+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.12+esm12"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6","2:1.18.4-0ubuntu0.7","2:1.18.4-0ubuntu0.8","2:1.18.4-0ubuntu0.9","2:1.18.4-0ubuntu0.10","2:1.18.4-0ubuntu0.11","2:1.18.4-0ubuntu0.12","2:1.18.4-0ubuntu0.12+esm1","2:1.18.4-0ubuntu0.12+esm2","2:1.18.4-0ubuntu0.12+esm4","2:1.18.4-0ubuntu0.12+esm5","2:1.18.4-0ubuntu0.12+esm6","2:1.18.4-0ubuntu0.12+esm8","2:1.18.4-0ubuntu0.12+esm9","2:1.18.4-0ubuntu0.12+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1","2:1.19.6-1ubuntu4.1~16.04.2","2:1.19.6-1ubuntu4.1~16.04.3","2:1.19.6-1ubuntu4.1~16.04.4","2:1.19.6-1ubuntu4.1~16.04.5","2:1.19.6-1ubuntu4.1~16.04.6","2:1.19.6-1ubuntu4.1~16.04.6+esm1","2:1.19.6-1ubuntu4.1~16.04.6+esm3","2:1.19.6-1ubuntu4.1~16.04.6+esm4","2:1.19.6-1ubuntu4.1~16.04.6+esm5","2:1.19.6-1ubuntu4.1~16.04.6+esm6","2:1.19.6-1ubuntu4.1~16.04.6+esm7","2:1.19.6-1ubuntu4.1~16.04.6+esm8","2:1.19.6-1ubuntu4.1~16.04.6+esm9","2:1.19.6-1ubuntu4.1~16.04.6+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.6-1ubuntu4.15+esm7"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1","2:1.19.6-1ubuntu4.2","2:1.19.6-1ubuntu4.3","2:1.19.6-1ubuntu4.4","2:1.19.6-1ubuntu4.5","2:1.19.6-1ubuntu4.6","2:1.19.6-1ubuntu4.7","2:1.19.6-1ubuntu4.8","2:1.19.6-1ubuntu4.9","2:1.19.6-1ubuntu4.10","2:1.19.6-1ubuntu4.11","2:1.19.6-1ubuntu4.12","2:1.19.6-1ubuntu4.13","2:1.19.6-1ubuntu4.14","2:1.19.6-1ubuntu4.15","2:1.19.6-1ubuntu4.15+esm1","2:1.19.6-1ubuntu4.15+esm3","2:1.19.6-1ubuntu4.15+esm4","2:1.19.6-1ubuntu4.15+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server-hwe-18.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.1-3ubuntu2.1~18.04.1","2:1.20.4-1ubuntu3~18.04.1","2:1.20.5+git20191008-0ubuntu1~18.04.1","2:1.20.8-2ubuntu2.1~18.04.1","2:1.20.8-2ubuntu2.2~18.04.1","2:1.20.8-2ubuntu2.2~18.04.2","2:1.20.8-2ubuntu2.2~18.04.3","2:1.20.8-2ubuntu2.2~18.04.4","2:1.20.8-2ubuntu2.2~18.04.5","2:1.20.8-2ubuntu2.2~18.04.6","2:1.20.8-2ubuntu2.2~18.04.7","2:1.20.8-2ubuntu2.2~18.04.8","2:1.20.8-2ubuntu2.2~18.04.9","2:1.20.8-2ubuntu2.2~18.04.10","2:1.20.8-2ubuntu2.2~18.04.11","2:1.20.8-2ubuntu2.2~18.04.11+esm1","2:1.20.8-2ubuntu2.2~18.04.11+esm2","2:1.20.8-2ubuntu2.2~18.04.11+esm3","2:1.20.8-2ubuntu2.2~18.04.11+esm4","2:1.20.8-2ubuntu2.2~18.04.11+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.13-1ubuntu1~20.04.16"}]}],"versions":["2:1.20.5+git20191008-0ubuntu1","2:1.20.6-1ubuntu1","2:1.20.7-2ubuntu1","2:1.20.7-2ubuntu2","2:1.20.8-2ubuntu2","2:1.20.8-2ubuntu2.1","2:1.20.8-2ubuntu2.2","2:1.20.8-2ubuntu2.3","2:1.20.8-2ubuntu2.4","2:1.20.8-2ubuntu2.6","2:1.20.9-2ubuntu1.1~20.04.1","2:1.20.9-2ubuntu1.2~20.04.1","2:1.20.9-2ubuntu1.2~20.04.2","2:1.20.11-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.3","2:1.20.13-1ubuntu1~20.04.4","2:1.20.13-1ubuntu1~20.04.5","2:1.20.13-1ubuntu1~20.04.6","2:1.20.13-1ubuntu1~20.04.8","2:1.20.13-1ubuntu1~20.04.9","2:1.20.13-1ubuntu1~20.04.12","2:1.20.13-1ubuntu1~20.04.14","2:1.20.13-1ubuntu1~20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.4-2ubuntu1.7~22.04.9"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:22.1.1-1ubuntu0.12"}]}],"versions":["2:21.1.2-0ubuntu1","2:21.1.3-1","2:21.1.3-1ubuntu1","2:21.1.4-1","2:22.1.0-1","2:22.1.1-1","2:22.1.1-1ubuntu0.1","2:22.1.1-1ubuntu0.2","2:22.1.1-1ubuntu0.3","2:22.1.1-1ubuntu0.4","2:22.1.1-1ubuntu0.5","2:22.1.1-1ubuntu0.6","2:22.1.1-1ubuntu0.7","2:22.1.1-1ubuntu0.9","2:22.1.1-1ubuntu0.10","2:22.1.1-1ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.12-1ubuntu1"}]}],"versions":["2:21.1.7-3ubuntu2","2:21.1.7-3ubuntu2.1","2:21.1.10-1ubuntu1","2:21.1.11-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.11+esm11"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10","2:1.15.1-0ubuntu2.11","2:1.15.1-0ubuntu2.11+esm2","2:1.15.1-0ubuntu2.11+esm3","2:1.15.1-0ubuntu2.11+esm4","2:1.15.1-0ubuntu2.11+esm5","2:1.15.1-0ubuntu2.11+esm6","2:1.15.1-0ubuntu2.11+esm7","2:1.15.1-0ubuntu2.11+esm8","2:1.15.1-0ubuntu2.11+esm9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.12+esm12"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6","2:1.18.4-0ubuntu0.7","2:1.18.4-0ubuntu0.8","2:1.18.4-0ubuntu0.9","2:1.18.4-0ubuntu0.10","2:1.18.4-0ubuntu0.11","2:1.18.4-0ubuntu0.12","2:1.18.4-0ubuntu0.12+esm1","2:1.18.4-0ubuntu0.12+esm2","2:1.18.4-0ubuntu0.12+esm4","2:1.18.4-0ubuntu0.12+esm5","2:1.18.4-0ubuntu0.12+esm6","2:1.18.4-0ubuntu0.12+esm8","2:1.18.4-0ubuntu0.12+esm9","2:1.18.4-0ubuntu0.12+esm10"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.6-1ubuntu4.15+esm7"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1","2:1.19.6-1ubuntu4.2","2:1.19.6-1ubuntu4.3","2:1.19.6-1ubuntu4.4","2:1.19.6-1ubuntu4.5","2:1.19.6-1ubuntu4.6","2:1.19.6-1ubuntu4.7","2:1.19.6-1ubuntu4.8","2:1.19.6-1ubuntu4.9","2:1.19.6-1ubuntu4.10","2:1.19.6-1ubuntu4.11","2:1.19.6-1ubuntu4.12","2:1.19.6-1ubuntu4.13","2:1.19.6-1ubuntu4.14","2:1.19.6-1ubuntu4.15","2:1.19.6-1ubuntu4.15+esm1","2:1.19.6-1ubuntu4.15+esm3","2:1.19.6-1ubuntu4.15+esm4","2:1.19.6-1ubuntu4.15+esm5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.13-1ubuntu1~20.04.16"}]}],"versions":["2:1.20.5+git20191008-0ubuntu1","2:1.20.6-1ubuntu1","2:1.20.7-2ubuntu1","2:1.20.7-2ubuntu2","2:1.20.8-2ubuntu2","2:1.20.8-2ubuntu2.1","2:1.20.8-2ubuntu2.2","2:1.20.8-2ubuntu2.3","2:1.20.8-2ubuntu2.4","2:1.20.8-2ubuntu2.6","2:1.20.9-2ubuntu1.1~20.04.1","2:1.20.9-2ubuntu1.2~20.04.1","2:1.20.9-2ubuntu1.2~20.04.2","2:1.20.11-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.3","2:1.20.13-1ubuntu1~20.04.4","2:1.20.13-1ubuntu1~20.04.5","2:1.20.13-1ubuntu1~20.04.6","2:1.20.13-1ubuntu1~20.04.8","2:1.20.13-1ubuntu1~20.04.9","2:1.20.13-1ubuntu1~20.04.12","2:1.20.13-1ubuntu1~20.04.14","2:1.20.13-1ubuntu1~20.04.15"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.4-2ubuntu1.7~22.04.9"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:22.1.1-1ubuntu0.12"}]}],"versions":["2:21.1.2-0ubuntu1","2:21.1.3-1","2:21.1.3-1ubuntu1","2:21.1.4-1","2:22.1.0-1","2:22.1.1-1","2:22.1.1-1ubuntu0.1","2:22.1.1-1ubuntu0.2","2:22.1.1-1ubuntu0.3","2:22.1.1-1ubuntu0.4","2:22.1.1-1ubuntu0.5","2:22.1.1-1ubuntu0.6","2:22.1.1-1ubuntu0.7","2:22.1.1-1ubuntu0.9","2:22.1.1-1ubuntu0.10","2:22.1.1-1ubuntu0.11"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.12-1.1"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-31082","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2271999","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://lists.x.org/archives/xorg-announce/2024-April/003497.html","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/03/13","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/12/10","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31082","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cm2m-f7gc-hv64"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-31082","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-31082","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31082.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-31082","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31083","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241199-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222309","tags":["report"]},{"url":"https://bugzilla.suse.com/1222310","tags":["report"]},{"url":"https://bugzilla.suse.com/1222311","tags":["report"]},{"url":"https://bugzilla.suse.com/1222312","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222442","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241261-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241262-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31082","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6721-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31083","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-31082","title":"Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T13:48:34.893Z","modified":"2026-11-04T21:12:30.148Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2024-28993","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T13:48:34Z","modified":"2026-11-04T21:12:30Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-04T22:46:32.144626Z"}],"ghsa":[{"id":"GHSA-cm2m-f7gc-hv64","title":"A heap-based buffer over-read vulnerability was found in the X.org server's...","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T15:30:34Z","modified":"2024-07-14T21:30:37Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:57:41.954948Z"}],"nvd":[{"id":"CVE-2024-31082","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T14:15:10.833Z","modified":"2026-11-04T22:17:20.637Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-126"],"updated_at":"2026-11-04T23:43:36.946093Z"}],"osv":[{"id":"ALPINE-CVE-2024-31082","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T14:15:10.833Z","modified":"2026-11-03T06:32:49.584504253Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"BELL-CVE-2024-31082","status":"published","published":"2024-04-05T05:57:49.759301Z","modified":"2026-01-26T09:36:33.08629Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-31082","title":"Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T13:48:34.893Z","modified":"2026-11-05T21:15:46.048528598Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-126"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"DEBIAN-CVE-2024-31082","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T14:15:10.833Z","modified":"2026-11-05T09:47:37.079777702Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2024-1416","title":"xorg-x11-server security update","description":"X.Org X11 X server\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-based buffer over-read vulnerability was found in the X.org server\u0026apos;s ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0026apos;s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.(CVE-2024-31080)\r\n\r\nA heap-based buffer over-read vulnerability was found in the X.org server\u0026apos;s ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0026apos;s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.(CVE-2024-31081)\r\n\r\nA heap-based buffer over-read vulnerability was found in the X.org server\u0026apos;s ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker\u0026apos;s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.(CVE-2024-31082)\r\n\r\nA use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.(CVE-2024-31083)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:21.440239361Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-31082","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-03-04T00:00:00Z","modified":"2026-04-22T14:49:16.153987Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-39112","title":"CVE-2024-31082 affecting package xorg-x11-server for versions less than 1.20.10-11","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T14:15:10Z","modified":"2026-04-21T04:28:39.962464Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-45393","title":"CVE-2024-31082 affecting package xorg-x11-server 1.20.10-6","description":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.","status":"published","published":"2024-04-04T14:15:10Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"openSUSE-SU-2024:13828-1","title":"xorg-x11-server-21.1.12-1.1 on GA media","description":"These are all security issues fixed in the xorg-x11-server-21.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:11.167939Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:1199-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2024-31080: Fixed ProcXIGetSelectedEvents to use unswapped length (bsc#1222309).\n- CVE-2024-31081: Fixed ProcXIPassiveGrabDevice to use unswapped length to send reply (bsc#1222310).\n- CVE-2024-31082: Fixed ProcAppleDRICreatePixmap to use unswapped length to send reply (bsc#1222311).\n- CVE-2024-31083: Fixed refcounting of glyphs during ProcRenderAddGlyphs (bsc#1222312).\n","status":"published","published":"2024-04-10T13:54:58Z","modified":"2026-02-04T02:47:18.613728Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1260-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2024-31080: Fixed ProcXIGetSelectedEvents to use unswapped length (bsc#1222309).\n- CVE-2024-31081: Fixed ProcXIPassiveGrabDevice to use unswapped length to send reply (bsc#1222310).\n- CVE-2024-31082: Fixed ProcAppleDRICreatePixmap to use unswapped length to send reply (bsc#1222311).\n- CVE-2024-31083: Fixed refcounting of glyphs during ProcRenderAddGlyphs (bsc#1222312).\n\nOther fixes:\n- Fixed regression for security fix for CVE-2024-31083 when using Android Studio (bnc#1222442)\n","status":"published","published":"2024-04-12T13:04:14Z","modified":"2026-02-04T02:43:07.49266Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1261-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2024-31080: Fixed ProcXIGetSelectedEvents to use unswapped length (bsc#1222309).\n- CVE-2024-31081: Fixed ProcXIPassiveGrabDevice to use unswapped length to send reply (bsc#1222310).\n- CVE-2024-31082: Fixed ProcAppleDRICreatePixmap to use unswapped length to send reply (bsc#1222311).\n- CVE-2024-31083: Fixed refcounting of glyphs during ProcRenderAddGlyphs (bsc#1222312).\n\nOther fixes:\n- Fixed regression for security fix for CVE-2024-31083 when using Android Studio (bnc#1222442)\n","status":"published","published":"2024-04-12T13:05:11Z","modified":"2026-02-04T03:22:26.042491Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1262-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2024-31080: Fixed ProcXIGetSelectedEvents to use unswapped length (bsc#1222309).\n- CVE-2024-31081: Fixed ProcXIPassiveGrabDevice to use unswapped length to send reply (bsc#1222310).\n- CVE-2024-31082: Fixed ProcAppleDRICreatePixmap to use unswapped length to send reply (bsc#1222311).\n- CVE-2024-31083: Fixed refcounting of glyphs during ProcRenderAddGlyphs (bsc#1222312).\n\nOther fixes:\n- Fixed regression for security fix for CVE-2024-31083 when using Android Studio (bnc#1222442)\n","status":"published","published":"2024-04-12T13:05:25Z","modified":"2026-02-04T04:03:38.633818Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6721-1","title":"xorg-server, xwayland vulnerabilities","description":"It was discovered that X.Org X Server incorrectly handled certain data.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2024-31080, CVE-2024-31081, CVE-2024-31082)\n\nIt was discovered that X.Org X Server incorrectly handled certain glyphs.\nAn attacker could possibly use this issue to cause a crash or expose sensitive\ninformation. (CVE-2024-31083)\n","status":"published","published":"2024-04-04T18:06:26Z","modified":"2026-06-29T13:51:07.246642358Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}