The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
Conclusion & alert: CVE-2008-0008 is rated Exploit Available (50/100): CVSS High severity, with low exploitation likelihood (EPSS 0.05%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-03-30 | 0.05% | 0.05% | +0.00% |
| 2 | 2025-03-29 | 0.05% | 0.05% | -0.01% |
| 3 | 2024-12-17 | — | 0.05% | — |
Full EPSS history (5 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.2 | 2.0 | HIGH |
|
3.9 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2008-0008 not yet assigned priority: Debian including 1 source packages (pulseaudio), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2008-0008 |
gentoo
|
high | CVE-2008-0008: 1 GLSA(s) (200802-07), 1 atom(s) (media-sound/pulseaudio); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2008-0008 |
suse
|
high | CVE-2008-0008 severity important: SUSE including 67 source package names (libpulse-browse0-0.9.21-1.5.26, libpulse-browse0-0.9.23-0.17.1, …), 79 product×package rows across 7 product lines (SUSE Linux Enterprise Server 11 SP1, SUSE Linux Enterprise Server 11 SP2, … (7 product lines)): Fixed 79. | https://www.suse.com/security/cve/CVE-2008-0008/ |
ubuntu
|
low | CVE-2008-0008 low priority: Ubuntu including 1 source packages (pulseaudio), 5 status rows across 5 suites (dapper, edgy, feisty, gutsy, upstream): released 3, DNE 2. | https://ubuntu.com/security/CVE-2008-0008 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| pulseaudio | pulseaudio | 0.9.6 | cpe:2.3:a:pulseaudio:pulseaudio:0.9.6:*:*:*:*:*:*:* |
| pulseaudio | pulseaudio | 0.9.8 | cpe:2.3:a:pulseaudio:pulseaudio:0.9.8:*:*:*:*:*:*:* |