Skip to content
OpenAdvisories
Medium USN-4640-1 1 CVE

pulseaudio vulnerability

Published Nov 23, 2020 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

James Henstridge discovered that an Ubuntu-specific patch caused
PulseAudio to incorrectly handle snap client connections. An attacker
could possibly use this to expose sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS pulseaudio 1:8.0-0ubuntu3.15
Ubuntu · 18.04 LTS 18.04:LTS pulseaudio 1:11.1-1ubuntu7.11
Ubuntu · 20.04 LTS 20.04:LTS pulseaudio 1:13.99.1-1ubuntu3.8

Vulnerabilities 1

  • Medium 4.4
    CVE-2020-16123

    Bypass of snapd pulseaudio restrictions

    An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without prope…

    Canonical PulseAudio pulseaudio Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-16123