CVE-2020-15710 MEDIUM

CVE-2020-15710: Potential double-free in pulseaudio

Vendor Canonical
Product PulseAudio
Weakness CWE-415
Published November 19, 2020
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.

Key dates

02Disclosure timeline

November 19, 2020 CVE published
September 17, 2024 Record updated