{"containers": {"cna": {"affected": [{"product": "pulseaudio", "vendor": "Canonical", "versions": [{"lessThan": "1:8.0-0ubuntu3.12", "status": "affected", "version": "1:8.0", "versionType": "custom"}, {"lessThan": "1:11.1-1ubuntu7.7", "status": "affected", "version": "1:11.1", "versionType": "custom"}, {"lessThan": "1:13.0-1ubuntu1.2", "status": "affected", "version": "1:13.0", "versionType": "custom"}, {"lessThan": "1:13.99.1-1ubuntu3.2", "status": "affected", "version": "1:13.99.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "James Henstridge"}], "datePublic": "2020-04-16T00:00:00", "descriptions": [{"lang": "en", "value": "An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-05-18T18:06:14", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3"}, {"name": "USN-4355-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4355-1/"}], "source": {"advisory": "https://usn.ubuntu.com/usn/usn-4355-1", "defect": ["https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/1877102"], "discovery": "INTERNAL"}, "title": "Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2020-04-16T00:00:00.000Z", "ID": "CVE-2020-11931", "STATE": "PUBLIC", "TITLE": "Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "pulseaudio", "version": {"version_data": [{"version_affected": "<", "version_name": "1:8.0", "version_value": "1:8.0-0ubuntu3.12"}, {"version_affected": "<", "version_name": "1:11.1", "version_value": "1:11.1-1ubuntu7.7"}, {"version_affected": "<", "version_name": "1:13.0", "version_value": "1:13.0-1ubuntu1.2"}, {"version_affected": "<", "version_name": "1:13.99.1", "version_value": "1:13.99.1-1ubuntu3.2"}]}}]}, "vendor_name": "Canonical"}]}}, "credit": [{"lang": "eng", "value": "James Henstridge"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3", "refsource": "MISC", "url": "https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3"}, {"name": "USN-4355-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4355-1/"}]}, "source": {"advisory": "https://usn.ubuntu.com/usn/usn-4355-1", "defect": ["https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/1877102"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:42:00.531Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3"}, {"name": "USN-4355-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4355-1/"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2020-11931", "datePublished": "2020-05-15T03:25:11.587553Z", "dateReserved": "2020-04-20T00:00:00", "dateUpdated": "2024-09-17T00:41:25.129Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pulseaudio:pulseaudio:*:*:*:*:*:*:*:*", "matchCriteriaId": "8509648D-0B4F-4ACB-819F-9DF2166BD9E6", "versionEndIncluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*", "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;"}, {"lang": "es", "value": "Una modificaci\u00f3n espec\u00edfica de Ubuntu para Pulseaudio para proporcionar mediaci\u00f3n de seguridad para aplicaciones empaquetadas de Snap se encontr\u00f3 que presenta una omisi\u00f3n de la restricci\u00f3n de acceso prevista para los snaps que conecta cualquiera pulseaudio, audio-playback o audio-record mediante la descarga del m\u00f3dulo de la pol\u00edtica de snap de pulseaudio. Este problema afecta a: pulseaudio versiones 1:8.0 anteriores a 1:8.0-0ubuntu3.12; versiones 1:11.1 anteriores a 1:11.1-1ubuntu7.7; versiones 1:13.0 anteriores a 1:13.0-1ubuntu1.2; versiones 1:13.99.1 anteriores a 1:13.99.1-1ubuntu3.2;"}], "id": "CVE-2020-11931", "lastModified": "2020-05-19T14:26:27.627", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2020-05-15T04:15:10.737", "references": [{"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3"}, {"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/4355-1/"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}