VDB
CVE-2008-0008
CVE-2008-0008
PUBLISHED
CVSS 7.199999809265137 HIGH
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
EPSS 0.56% · 44.5th percentile
Risk Scores
CVSS 2.0
7.199999809265137
EPSS Score
0.56%
44.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| pulseaudio | pulseaudio | 0.9.6, 0.9.8 |
Timeline
- Jan 28, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 13, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- May 31, 2023 EPSS Score
- Jul 23, 2023 EPSS Score
References
- MDVSA-2008:027 vendor-advisory
- 28623 third-party-advisory
- [pulseaudio-discuss] 20080124 [ANNOUNCE] PulseAudio 0.9.9 mailing-list
- http://pulseaudio.org/changeset/2100 url
- DSA-1476 vendor-advisory
- GLSA-200802-07 vendor-advisory
- FEDORA-2008-0994 vendor-advisory
- 28952 third-party-advisory
- 27449 vdb
- ADV-2008-0283 vdb
- http://bugs.gentoo.org/show_bug.cgi?id=207214 url
- FEDORA-2008-0963 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=425481 url
- 28738 third-party-advisory
- pulseaudio-padroproot-privilege-escalation(39992) vdb
- USN-573-1 vendor-advisory
- 28608 third-party-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=347822 url
- https://nvd.nist.gov/vuln/detail/CVE-2008-0008 advisory