VDB
CVE-2008-0008
CVE-2008-0008
PUBLISHED
CVSS 7.199999809265137 HIGH
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
EPSS 0.05% · 15.9th percentile
Risk Scores
CVSS 2.0
7.199999809265137
EPSS Score
0.05%
15.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| pulseaudio | pulseaudio | 0.9.6, 0.9.8 |
Timeline
- Jan 28, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 25, 2023 EPSS Score
References
- MDVSA-2008:027 vendor-advisory
- 27449 vdb
- 28623 third-party-advisory
- [pulseaudio-discuss] 20080124 [ANNOUNCE] PulseAudio 0.9.9 mailing-list
- http://pulseaudio.org/changeset/2100 url
- ADV-2008-0283 vdb
- http://bugs.gentoo.org/show_bug.cgi?id=207214 url
- DSA-1476 vendor-advisory
- FEDORA-2008-0963 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=425481 url
- GLSA-200802-07 vendor-advisory
- FEDORA-2008-0994 vendor-advisory
- 28738 third-party-advisory
- pulseaudio-padroproot-privilege-escalation(39992) vdb
- USN-573-1 vendor-advisory
- 28952 third-party-advisory
- 28608 third-party-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=347822 url
- https://nvd.nist.gov/vuln/detail/CVE-2008-0008 advisory