This advisory covers three security flaws in the xorg-x11-server-Xwayland package for Red Hat Enterprise Linux 9. The first two vulnerabilities (CVE-2024-31080 and CVE-2024-31081) involve heap buffer overreads that could lead to data leakage in the ProcXIGetSelectedEvents and ProcXIPassiveGrabDevice functions, respectively. The third vulnerability (CVE-2024-31083) is a use-after-free bug in the ProcRenderAddGlyphs function. These issues could potentially be exploited to leak sensitive information or cause instability in the Xwayland server. Red Hat has released updated packages as part of the RHEL 9.5 release to remediate these vulnerabilities.

The vulnerabilities could allow an attacker to cause heap buffer overreads leading to data leakage or trigger use-after-free conditions, potentially resulting in information disclosure or application instability within the Xwayland server environment. The impact is rated as moderate by Red Hat Product Security. There are no known exploits in the wild at this time.

Red Hat has released an official security update for xorg-x11-server-Xwayland as part of Red Hat Enterprise Linux 9.5. Users should apply the update promptly to remediate the vulnerabilities. Detailed update instructions are available in the Red Hat advisory and associated documentation. No additional mitigation steps are indicated beyond applying the official patch.