CVE-2020-15710 — MEDIUM (5.3)

Vulnerability Description

Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Pulseaudio Project	Pulseaudio	1\
Canonical	Ubuntu Linux	16.04

Related Weaknesses (CWE)

CWE-415

References

https://launchpad.net/bugs/1884738Issue TrackingThird Party Advisory
https://ubuntu.com/USN-4519-1Third Party Advisory
https://launchpad.net/bugs/1884738Issue TrackingThird Party Advisory
https://ubuntu.com/USN-4519-1Third Party Advisory

FAQ

What is CVE-2020-15710?

CVE-2020-15710 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/blu...

How severe is CVE-2020-15710?

CVE-2020-15710 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-15710?

Check the references section above for vendor advisories and patch information. Affected products include: Pulseaudio Project Pulseaudio, Canonical Ubuntu Linux.