{"id":"CVE-2020-16123","aliases":["EUVD-2020-8089","GHSA-h38w-g4mp-rwv7","UBUNTU-CVE-2020-16123","USN-4640-1"],"status":"published","title":"Bypass of snapd pulseaudio restrictions","description":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00318,"percentile":0.25099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2020-11-23T16:03:54Z","modified":"2026-06-17T02:57:44Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"pulseaudio","fixed_in":["1:8.0-0ubuntu3.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pulseaudio","fixed_in":["1:11.1-1ubuntu7.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pulseaudio","fixed_in":["1:13.99.1-1ubuntu3.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0-0ubuntu3.15"}]}],"versions":["1:6.0-0ubuntu13","1:7.1-1ubuntu1","1:7.1-1ubuntu2","1:7.1-1ubuntu3","1:7.1-1ubuntu6","1:7.1-1ubuntu7","1:8.0-0ubuntu2","1:8.0-0ubuntu3","1:8.0-0ubuntu3.1","1:8.0-0ubuntu3.2","1:8.0-0ubuntu3.3","1:8.0-0ubuntu3.4","1:8.0-0ubuntu3.7","1:8.0-0ubuntu3.8","1:8.0-0ubuntu3.9","1:8.0-0ubuntu3.10","1:8.0-0ubuntu3.11","1:8.0-0ubuntu3.12","1:8.0-0ubuntu3.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.1-1ubuntu7.11"}]}],"versions":["1:10.0-2ubuntu3","1:11.1-1ubuntu1","1:11.1-1ubuntu2","1:11.1-1ubuntu4","1:11.1-1ubuntu5","1:11.1-1ubuntu6","1:11.1-1ubuntu7","1:11.1-1ubuntu7.1","1:11.1-1ubuntu7.2","1:11.1-1ubuntu7.4","1:11.1-1ubuntu7.5","1:11.1-1ubuntu7.7","1:11.1-1ubuntu7.8","1:11.1-1ubuntu7.9","1:11.1-1ubuntu7.10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:13.99.1-1ubuntu3.8"}]}],"versions":["1:13.0-1ubuntu1","1:13.0-1ubuntu4","1:13.0-1ubuntu5","1:13.0-3ubuntu1","1:13.0-3ubuntu2","1:13.99.1-1ubuntu1","1:13.99.1-1ubuntu2","1:13.99.1-1ubuntu3","1:13.99.1-1ubuntu3.2","1:13.99.1-1ubuntu3.3","1:13.99.1-1ubuntu3.4","1:13.99.1-1ubuntu3.5","1:13.99.1-1ubuntu3.6","1:13.99.1-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0-0ubuntu3.15"}]}],"versions":["1:6.0-0ubuntu13","1:7.1-1ubuntu1","1:7.1-1ubuntu2","1:7.1-1ubuntu3","1:7.1-1ubuntu6","1:7.1-1ubuntu7","1:8.0-0ubuntu2","1:8.0-0ubuntu3","1:8.0-0ubuntu3.1","1:8.0-0ubuntu3.2","1:8.0-0ubuntu3.3","1:8.0-0ubuntu3.4","1:8.0-0ubuntu3.7","1:8.0-0ubuntu3.8","1:8.0-0ubuntu3.9","1:8.0-0ubuntu3.10","1:8.0-0ubuntu3.11","1:8.0-0ubuntu3.12","1:8.0-0ubuntu3.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.1-1ubuntu7.11"}]}],"versions":["1:10.0-2ubuntu3","1:11.1-1ubuntu1","1:11.1-1ubuntu2","1:11.1-1ubuntu4","1:11.1-1ubuntu5","1:11.1-1ubuntu6","1:11.1-1ubuntu7","1:11.1-1ubuntu7.1","1:11.1-1ubuntu7.2","1:11.1-1ubuntu7.4","1:11.1-1ubuntu7.5","1:11.1-1ubuntu7.7","1:11.1-1ubuntu7.8","1:11.1-1ubuntu7.9","1:11.1-1ubuntu7.10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:13.99.1-1ubuntu3.8"}]}],"versions":["1:13.0-1ubuntu1","1:13.0-1ubuntu4","1:13.0-1ubuntu5","1:13.0-3ubuntu1","1:13.0-3ubuntu2","1:13.99.1-1ubuntu1","1:13.99.1-1ubuntu2","1:13.99.1-1ubuntu3","1:13.99.1-1ubuntu3.2","1:13.99.1-1ubuntu3.3","1:13.99.1-1ubuntu3.4","1:13.99.1-1ubuntu3.5","1:13.99.1-1ubuntu3.6","1:13.99.1-1ubuntu3.7"]}],"products":[{"vendor":"canonical","product":"pulseaudio"},{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"https://launchpad.net/bugs/1895928","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://ubuntu.com/USN-4640-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16123"},{"url":"https://github.com/advisories/GHSA-h38w-g4mp-rwv7"},{"url":"https://ubuntu.com/security/CVE-2020-16123","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4640-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16123","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-16123","title":"Bypass of snapd pulseaudio restrictions","description":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.","status":"published","published":"2020-12-03T23:15:20.305Z","modified":"2024-09-16T19:20:12.173Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8089","description":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.","status":"published","published":"2020-12-03T23:15:20Z","modified":"2024-09-16T19:20:12Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:24.213258Z"}],"ghsa":[{"id":"GHSA-h38w-g4mp-rwv7","title":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module...","description":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.","status":"published","published":"2022-05-24T17:35:22Z","modified":"2023-01-29T05:05:30Z","cwes":["CWE-362"],"updated_at":"2026-11-02T14:45:48.396935Z"}],"nvd":[{"id":"CVE-2020-16123","description":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.","status":"published","published":"2020-12-04T00:15:11.88Z","modified":"2026-06-17T02:57:44.95Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"UBUNTU-CVE-2020-16123","description":"An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.","status":"published","published":"2020-11-23T17:00:00Z","modified":"2026-04-22T12:31:41.621007Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"USN-4640-1","title":"pulseaudio vulnerability","description":"James Henstridge discovered that an Ubuntu-specific patch caused\nPulseAudio to incorrectly handle snap client connections. An attacker\ncould possibly use this to expose sensitive information.\n","status":"published","published":"2020-11-23T16:03:54Z","modified":"2026-04-22T10:10:03.869157Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}