Vulnerability Description
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.
CVSS Score
2.9
LOW
AV:A/AC:M/Au:N/C:N/I:N/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pulseaudio | Pulseaudio | 1.0 |
References
- http://advisories.mageia.org/MGASA-2014-0440.html
- http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.htmlExploit
- http://seclists.org/oss-sec/2014/q2/429
- http://seclists.org/oss-sec/2014/q2/437
- http://secunia.com/advisories/60624
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:134
- http://www.securityfocus.com/bid/67814
- http://advisories.mageia.org/MGASA-2014-0440.html
- http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.htmlExploit
- http://seclists.org/oss-sec/2014/q2/429
- http://seclists.org/oss-sec/2014/q2/437
- http://secunia.com/advisories/60624
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:134
- http://www.securityfocus.com/bid/67814
FAQ
What is CVE-2014-3970?
CVE-2014-3970 is a vulnerability with a CVSS score of 2.9 (LOW). The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empt...
How severe is CVE-2014-3970?
CVE-2014-3970 has been rated LOW with a CVSS base score of 2.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-3970?
Check the references section above for vendor advisories and patch information. Affected products include: Pulseaudio Pulseaudio.