CVE-2020-11931: Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-11931?
CVE-2020-11931 is an Ubuntu-specific modification to Pulseaudio that provides security mediation for Snap-packaged applications.
What is the severity of CVE-2020-11931?
The severity of CVE-2020-11931 is low with a CVSS score of 3.3.
Which versions of Pulseaudio are affected by CVE-2020-11931?
Pulseaudio versions 1:8.0-0ubuntu3.12, 1:11.1-1ubuntu7.7, 1:13.0-1ubuntu1.2, and 1:13.99.1-1ubuntu3.2 are affected by CVE-2020-11931.
How can I fix CVE-2020-11931?
To fix CVE-2020-11931, update your Pulseaudio package to the corresponding fixed version: 1:8.0-0ubuntu3.12, 1:11.1-1ubuntu7.7, 1:13.0-1ubuntu1.2, or 1:13.99.1-1ubuntu3.2.
Where can I find more information about CVE-2020-11931?
You can find more information about CVE-2020-11931 at the following references: [Link 1](https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3), [Link 2](https://usn.ubuntu.com/4355-1/), [Link 3](https://launchpad.net/bugs/cve/CVE-2020-11931).