An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade pulseaudio-equalizerUpgrade pulseaudio-module-zeroconfUpgrade libpulse0Upgrade pulseaudio-module-jackUpgrade pulseaudio-module-x11Upgrade pulseaudioUpgrade pulseaudio-module-raopUpgrade pulseaudio-module-lircUpgrade pulseaudio-module-gsettingsUpgrade libpulsedspUpgrade pulseaudio-utilsUpgrade pulseaudio-module-bluetoothUpgrade pulseaudio-module-droidUpgrade libpulse-mainloop-glib0Upgrade pulseaudio-module-trust-storeUpgrade pulseaudio-esound-compatUpgrade pulseaudio-module-gconf | Nov 24, 2020 | Nov 23, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub