An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;

The partprecv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.

The pamakesecuredir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.

Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LDBINDNOW to 1, and then calling execv on the target of the /proc/self/exe symlink.

PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via (1) a PAPSTREAMDESCRIPTORLENGTH value of FRAMESIZEMAXALLOW sent on TCP port 9875, which triggers a p->export assertion failure in doread; (2) a PAPSTREAMDESCRIPTORLENGTH value of 0 sent on TCP port 9875, which triggers a length assertion failure in pamemblocknew; or (3) an empty packet on UDP port 9875, which triggers a t assertion failure in pasdpparse; and allows remote authenticated users to cause a denial of service (daemon crash) via a crafted packet on TCP port 9875 that (4) triggers a maxlength assertion failure in pamemblockqnew, (5) triggers a size assertion failure in paxmalloc, or (6) plays a certain sound file.