Vulnerability Details CVE-2014-3970
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.7%
CVSS Severity
CVSS v2 Score 2.9
References
- http://advisories.mageia.org/MGASA-2014-0440.html
- http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.html
- http://seclists.org/oss-sec/2014/q2/429
- http://seclists.org/oss-sec/2014/q2/437
- http://secunia.com/advisories/60624
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:134
- http://www.securityfocus.com/bid/67814
- http://advisories.mageia.org/MGASA-2014-0440.html
- http://lists.freedesktop.org/archives/pulseaudio-discuss/2014-May/020740.html
- http://seclists.org/oss-sec/2014/q2/429
- http://seclists.org/oss-sec/2014/q2/437
- http://secunia.com/advisories/60624
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:134
- http://www.securityfocus.com/bid/67814
Products affected by CVE-2014-3970
-
cpe:2.3:a:pulseaudio:pulseaudio:1.0
-
cpe:2.3:a:pulseaudio:pulseaudio:1.1
-
cpe:2.3:a:pulseaudio:pulseaudio:1.99.1
-
cpe:2.3:a:pulseaudio:pulseaudio:1.99.2
-
cpe:2.3:a:pulseaudio:pulseaudio:2.0
-
cpe:2.3:a:pulseaudio:pulseaudio:2.1
-
cpe:2.3:a:pulseaudio:pulseaudio:3.0
-
cpe:2.3:a:pulseaudio:pulseaudio:4.0
-
cpe:2.3:a:pulseaudio:pulseaudio:5.0