USN-4519-1

Ratchanan Srirattanamet discovered that an Ubuntu-specific patch caused PulseAudio to incorrectly handle memory under certain error conditions in the Bluez 5 module. An attacker could use this issue to cause PulseAudio to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-15710)

References

Affected packages

Ubuntu:16.04:LTS / pulseaudio

Package

Name: pulseaudio
Purl: pkg:deb/ubuntu/pulseaudio@1:8.0-0ubuntu3.14?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:8.0-0ubuntu3.14

Affected versions

1:6.*

1:6.0-0ubuntu13

1:7.*

1:7.1-1ubuntu1

1:7.1-1ubuntu2

1:7.1-1ubuntu3

1:7.1-1ubuntu6

1:7.1-1ubuntu7

1:8.*

1:8.0-0ubuntu2

1:8.0-0ubuntu3

1:8.0-0ubuntu3.1

1:8.0-0ubuntu3.2

1:8.0-0ubuntu3.3

1:8.0-0ubuntu3.4

1:8.0-0ubuntu3.7

1:8.0-0ubuntu3.8

1:8.0-0ubuntu3.9

1:8.0-0ubuntu3.10

1:8.0-0ubuntu3.11

1:8.0-0ubuntu3.12

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpulse-mainloop-glib0",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "libpulse0",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "libpulsedsp",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-esound-compat",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-bluetooth",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-droid",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-gconf",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-jack",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-lirc",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-raop",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-trust-store",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-x11",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-module-zeroconf",
            "binary_version": "1:8.0-0ubuntu3.14"
        },
        {
            "binary_name": "pulseaudio-utils",
            "binary_version": "1:8.0-0ubuntu3.14"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4519-1.json"

cves_map

{
    "ecosystem": "Ubuntu:16.04:LTS",
    "cves": [
        {
            "id": "CVE-2020-15710",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}