vulnwire
8.8high

CVE-2018-16263

The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security pol…

Published 6 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 56%
Public exploits
0
none known

The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

Exploit prediction (EPSS)

0.78% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.05.8AV:A/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

  • media.defcon.org /DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi% · x_refsource_MISC, x_transferred
  • review.tizen.org /git/?p=platform/upstream/pulseaudio.git%3Ba=commit%3Bh=81e8ba9f3ab0917da4fdfa094f49333be5 · x_refsource_MISC, x_transferred
  • youtube.com /watch?v=3IdgBwbOT-g&feature=youtu.be · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.