The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pulseaudio | Jul 30, 2024 | Mar 18, 2010 |
| Gentoo Linux | — | Upgrade media-sound/pulseaudio. | Oct 30, 2017 | Mar 18, 2010 |
| Suse | — | Upgrade pulseaudio-module-gconfUpgrade pulseaudio-module-zeroconfUpgrade libpulse0-64bitUpgrade pulseaudio-module-x11Upgrade pulseaudio-esound-compatUpgrade pulseaudioUpgrade pulseaudio-module-jackUpgrade libpulse0-32bitUpgrade pulseaudio-module-lircUpgrade libpulse-develUpgrade libpulse-mainloop-glib0Upgrade libpulse-browse0Upgrade libpulsecore4Upgrade pulseaudio-utilsUpgrade libpulse0Upgrade pulseaudio-gdm-hooksUpgrade pulseaudio-module-bluetoothUpgrade pulseaudio-lang | Feb 17, 2015 | Mar 18, 2010 |
| Ubuntu | — | Upgrade pulseaudio | Nov 19, 2024 | Mar 18, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub