group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1877102@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package pulseaudio - 1:13.99.1-1ubuntu6

---------------
pulseaudio (1:13.99.1-1ubuntu6) groovy; urgency=medium

  * debian/patches/git_config_upgrade.patch:
     -stream-restore: Forget pre-14.0 stream routing, old configurations are
      incompatible and create routing issues where e.g the speaker despite
      having headset selected (lp: #1866194)
  * debian/rules:
    - enable --enable-stream-restore-clear-old-devices
  * debian/rules:
    - don't let tests fail build on riscv

 -- Sebastien Bacher <seb128@xxxxxxxxxx>  Wed, 03 Jun 2020 17:28:51
+0200

** Changed in: pulseaudio (Ubuntu Groovy)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1877102

Title:
  snap policy module can be unloaded, circumventing audio recording
  restrictions for snaps

Status in pulseaudio package in Ubuntu:
  Fix Released
Status in pulseaudio source package in Xenial:
  Fix Released
Status in pulseaudio source package in Bionic:
  Fix Released
Status in pulseaudio source package in Eoan:
  Fix Released
Status in pulseaudio source package in Focal:
  Fix Released
Status in pulseaudio source package in Groovy:
  Fix Released

Bug description:
  This collates information about a security vulnerability discussed in
  email.  It has been assigned CVE-2020-11931.

  Ubuntu's PulseAudio package is shipped with a custom "module-snap-
  policy" module intended to restrict snap confined clients from
  recording audio unless they have the "audio-record" plug connected.
  However, it does not restrict access to the "PA_COMMAND_UNLOAD_MODULE"
  command.

  This allows a snap that has only plugged "audio-playback" to request
  that PulseAudio unload the security policy module, which in turn makes
  it possible to record audio.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/1877102/+subscriptions