An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade pulseaudio-module-gconfUpgrade libpulsedspUpgrade pulseaudio-utilsUpgrade pulseaudio-module-lircUpgrade libpulse-mainloop-glib0Upgrade pulseaudio-esound-compatUpgrade pulseaudio-module-trust-storeUpgrade pulseaudio-module-droidUpgrade pulseaudio-module-bluetoothUpgrade pulseaudio-module-gsettingsUpgrade pulseaudio-equalizerUpgrade pulseaudio-module-jackUpgrade pulseaudio-module-x11Upgrade pulseaudioUpgrade libpulse0Upgrade pulseaudio-module-zeroconfUpgrade pulseaudio-module-raop | Nov 24, 2020 | Nov 23, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub