Ubuntu 20.04: USN-4355-1 Critical: PulseAudio Snap Package Access Issue

ubuntu

May 12, 2020

PulseAudio could allow unintended access to snap packages.

Summary

PulseAudio could allow unintended access to snap packages.

Software Description:

- pulseaudio: PulseAudio sound server

Details:

PulseAudio in Ubuntu contains additional functionality to mediate audio

recording for snap packages and it was discovered that this functionality

did not mediate PulseAudio module unloading. An attacker-controlled snap

with only the audio-playback interface connected could exploit this to

bypass access controls and record audio.

Topics Covered

security advisory security issue Ubuntu PulseAudio audio access snap packages

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  pulseaudio                      1:13.99.1-1ubuntu3.2

Ubuntu 19.10:
  pulseaudio                      1:13.0-1ubuntu1.2

Ubuntu 18.04 LTS:
  pulseaudio                      1:11.1-1ubuntu7.7

Ubuntu 16.04 LTS:
  pulseaudio                      1:8.0-0ubuntu3.12

After a standard system update you need to restart your session to make
all the necessary changes.