Base Score

MEDIUM5.5

CVE-2022-4964

Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.

VectorLOCAL

Published Bysecurity@ubuntu.com

Published DateJan 24, 2024, 01:15

Weakness Type (CWE):CWE-276

CVSS Metrics

Base Score

5.5

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

NONE

Availability (A)

NONE

References

https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4964
https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779
https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567

Base Score

MEDIUM5.5

Weakness Type (CWE):CWE-276

CVSS Metrics

Base Score

5.5

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

NONE

Availability (A)

NONE