UbuntuUpdates.org

Package "libpulse0"

Name: libpulse0

Description:

PulseAudio client libraries

Latest version: 1:8.0-0ubuntu3.15
Release: xenial (16.04)
Level: updates
Repository: main
Head package: pulseaudio
Homepage: http://www.pulseaudio.org

Links


Download "libpulse0"


Other versions of "libpulse0" in Xenial

Repository Area Version
base main 1:8.0-0ubuntu3
security main 1:8.0-0ubuntu3.15

Changelog

Version: 1:8.0-0ubuntu3.15 2020-11-23 17:08:03 UTC

  pulseaudio (1:8.0-0ubuntu3.15) xenial-security; urgency=medium

  * SECURITY UPDATE: don't rely on SCM_CREDENTIALS to detect snap confined
    clients (LP: #1895928)
    - d/p/0418-pa-client-peer-apparmor-label.patch: records AppArmor label
      in pa_client struct for native connections using aa_getpeercon.
    - d/p/0452-add-snappy-policy-module.patch: use the AppArmor
      label in the pa_client rather than looking it up via the process ID
      from SCM_CREDENTIALS.
    - CVE-2020-16123
   * Don't block classic snaps from module loading/unloading (LP: #1886854)
    - d/p/0452-add-snappy-policy-module.patch: replace
      deny_to_snaps_hook with a version that allows classic snaps.

 -- James Henstridge <email address hidden> Tue, 22 Sep 2020 12:30:20 +0800

Source diff to previous version
1886854 Race in load-module snap policy check in classic confinement
CVE-2020-16123 RESERVED

Version: 1:8.0-0ubuntu3.14 2020-09-17 23:06:18 UTC

  pulseaudio (1:8.0-0ubuntu3.14) xenial-security; urgency=medium

  * SECURITY UPDATE: potential double-free in the Bluez 5 module (LP: #1884738)
    - d/p/0511-bluetooth-bluez5-fix-double-free-in-pa__init.patch:
      Only free modargs once in each of
      src/modules/bluetooth/module-bluez5-device.c and
      src/modules/bluetooth/module-bluez5-discover.c, patch thanks to Ratchanan
      Srirattanamet.
    - d/p/0512-bluetooth-bluez5-fix-double-free-2.patch: Initialize pointer
      before dereferencing in fail condition.
    - CVE-2020-15710

 -- Avital Ostromich <email address hidden> Thu, 17 Sep 2020 09:38:52 -0400

Source diff to previous version
1884738 Pulseaudio in Ubuntu 16.04 contains a potential double-free bug in Bluez 5 module
CVE-2020-15710 RESERVED

Version: 1:8.0-0ubuntu3.12 2020-05-12 21:07:09 UTC

  pulseaudio (1:8.0-0ubuntu3.12) xenial-security; urgency=medium

  * SECURITY UPDATE: stop snaps from loading and unloading modules, to
    prevent bypass of audio recording restriction (LP: #1877102). Patch thanks
    to James Henstridge
    - d/p/0407-access-Add-access-control-hooks.patch: make sure access
      hook IDs are non-zero.
    - d/p/0450-modules-add-snappy-policy-module.patch: Prevent snaps from
      controlling modules, terminating the daemon, or disconnecting clients.
    - CVE-2020-11931
  * debian/control: Build-Depends on libsnapd-glib-dev (>= 1.49)

 -- Jamie Strandboge <email address hidden> Thu, 07 May 2020 20:43:53 +0000

Source diff to previous version
1877102 snap policy module can be unloaded, circumventing audio recording restrictions for snaps
CVE-2020-11931 RESERVED

Version: 1:8.0-0ubuntu3.11 2019-12-11 03:06:24 UTC

  pulseaudio (1:8.0-0ubuntu3.11) xenial; urgency=medium

  * Backport the snap policy module to make access to audio recording
    conditional on plugging the "pulseaudio" or "audio-record" interfaces
    (LP: #1781428):
    - 0450-modules-add-snappy-policy-module.patch: rewrite to query
      snapd for the client's plugged interfaces.
    - 0451-enable-snap-policy-module.patch: enable the module in the
      default configuration.
    - Build depend on libsnapd-glib-dev.
  * Backport libjson-c dependency removal from Pulse Audio 10. This is
    required by the snap policy module due to a symbol name clash with
    libjson-glib.
    - 0805-remove-libjson-c-dependency.patch: new file.

 -- James Henstridge <email address hidden> Tue, 05 Nov 2019 17:16:22 +0800

Source diff to previous version
1781428 please enable snap mediation support

Version: 1:8.0-0ubuntu3.10 2018-05-03 07:06:59 UTC

  pulseaudio (1:8.0-0ubuntu3.10) xenial; urgency=medium

  * Revert Cherrypick fixes for checking profile availabilities
change of 3.9, then the content of 1:8.0-0ubuntu3.10 is same as
1:8.0-0ubuntu3.8 (LP: #1767784)

 -- Hui Wang <email address hidden> Wed, 2 May 2018 15:32:26 +0800

1767784 [regression] output device not recognized anymore since update 1:8.0-0ubuntu3.9



About   -   Send Feedback to @ubuntu_updates