CVE Feed

    Dashboard / CVE / CVE-2007-1804

    CVE-2007-1804

    PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via (1) a PA_PSTREAM_DESCRIPTOR_LENGTH value of FRAME_SIZE_MAX_ALLOW sent on TCP port 9875, which triggers a p->export assertion failure in do_read; (2) a PA_PSTREAM_DESCRIPTOR_LENGTH value of 0 sent on TCP port 9875, which triggers a length assertion failure in pa_memblock_new; or (3) an empty packet on UDP port 9875, which triggers a t assertion failure in pa_sdp_parse; and allows remote authenticated users to cause a denial of service (daemon crash) via a crafted packet on TCP port 9875 that (4) triggers a maxlength assertion failure in pa_memblockq_new, (5) triggers a size assertion failure in pa_xmalloc, or (6) plays a certain sound file.

    Published:Apr 2, 2007
    Last Modified:Apr 23, 2026
    EPS:Apr 2, 2007
    EPSS Score:0.23979
    CVSS Score:7.8

    Affected Products

    Vendor
    Pulseaudio
    Product
    Pulseaudio

    Exploits

    https://www.exploit-db.com/exploits/29809

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-11586 (CVSS 4) — Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connecte…
    CVE-2020-11931 (CVSS 3.3) — An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was…
    CVE-2014-3970 (CVSS 2.9) — The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allo…
    CVE-2009-1299 (CVSS 6.9) — The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change th…
    CVE-2009-1894 (CVSS 7.2) — Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors invol…
    CVE-2008-0008 (CVSS 7.2) — The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1…

    References

    http://aluigi.altervista.org/adv/pulsex-adv.txt
    http://aluigi.org/poc/pulsex.zip
    http://secunia.com/advisories/25431
    http://secunia.com/advisories/25787
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:065
    http://www.novell.com/linux/security/advisories/2007_13_sr.html
    http://www.securityfocus.com/bid/23240
    http://www.ubuntu.com/usn/usn-465-1
    http://www.vupen.com/english/advisories/2007/1214
    https://exchange.xforce.ibmcloud.com/vulnerabilities/33315
    http://aluigi.altervista.org/adv/pulsex-adv.txt
    http://aluigi.org/poc/pulsex.zip
    http://secunia.com/advisories/25431
    http://secunia.com/advisories/25787
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:065
    http://www.novell.com/linux/security/advisories/2007_13_sr.html
    http://www.securityfocus.com/bid/23240
    http://www.ubuntu.com/usn/usn-465-1
    http://www.vupen.com/english/advisories/2007/1214
    https://exchange.xforce.ibmcloud.com/vulnerabilities/33315

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High