CVE-2020-15710

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
Canonical	PulseAudio	>= 1:8.0, < 1:8.0-0ubuntu3.14

References

https://launchpad.net/bugs/1884738Issue Tracking, Third Party Advisory
https://ubuntu.com/USN-4519-1Third Party Advisory
https://launchpad.net/bugs/1884738Issue Tracking, Third Party Advisory
https://ubuntu.com/USN-4519-1Third Party Advisory

Timeline

Published: Nov 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-157118.8In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.CVE-2020-157124.3rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to CVE-2020-157138.8rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script us CVE-2020-157148.8rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php scri CVE-2020-157159.9rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.ph CVE-2020-157166.1RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker CVE-2020-157176.1RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker CVE-2020-157186.1RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attac CVE-2020-157194.2libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support CVE-2020-157206.8In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify par CVE-2020-157216.1RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.CVE-2020-157227.8In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnera