CVE-2008-0008

The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.

• CWE-20

• http://bugs.gentoo.org/show_bug.cgi?id=207214Third Party Advisory
• http://pulseaudio.org/changeset/2100Exploit
• http://secunia.com/advisories/28608Vendor Advisory
• http://secunia.com/advisories/28623Vendor Advisory
• http://secunia.com/advisories/28738Vendor Advisory
• http://secunia.com/advisories/28952Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200802-07.xmlThird Party Advisory
• http://www.debian.org/security/2008/dsa-1476Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:027Third Party Advisory
• http://www.securityfocus.com/bid/27449Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-573-1Third Party Advisory
• http://www.vupen.com/english/advisories/2008/0283Vendor Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=347822Issue Tracking
• https://bugzilla.redhat.com/show_bug.cgi?id=425481Issue Tracking
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39992VDB Entry
• https://tango.0pointer.de/pipermail/pulseaudio-discuss/2008-January/001228.htmlBroken Link
• https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00852.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00869.htmlThird Party Advisory
• http://bugs.gentoo.org/show_bug.cgi?id=207214Third Party Advisory
• http://pulseaudio.org/changeset/2100Exploit
• http://secunia.com/advisories/28608Vendor Advisory
• http://secunia.com/advisories/28623Vendor Advisory
• http://secunia.com/advisories/28738Vendor Advisory
• http://secunia.com/advisories/28952Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200802-07.xmlThird Party Advisory
• http://www.debian.org/security/2008/dsa-1476Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:027Third Party Advisory
• http://www.securityfocus.com/bid/27449Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-573-1Third Party Advisory
• http://www.vupen.com/english/advisories/2008/0283Vendor Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=347822Issue Tracking
• https://bugzilla.redhat.com/show_bug.cgi?id=425481Issue Tracking
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39992VDB Entry
• https://tango.0pointer.de/pipermail/pulseaudio-discuss/2008-January/001228.htmlBroken Link
• https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00852.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00869.htmlThird Party Advisory

Published

Jan 29, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0002Apache Tomcat 6.0.0 through 6.0.15 processes parameters in t…
• CVE-2008-0003Stack-based buffer overflow in the PAMBasicAuthenticator::PA…
• CVE-2008-0004Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2008-0005mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before…
• CVE-2008-0006Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) t…
• CVE-2008-0007Linux kernel before 2.6.22.17, when using certain drivers th…
• CVE-2008-0009The vmsplice_to_user function in fs/splice.c in the Linux ke…
• CVE-2008-0010The copy_from_user_mmap_sem function in fs/splice.c in the L…
• CVE-2008-0011Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft…
• CVE-2008-0012Heap-based buffer overflow in an unspecified procedure in Tr…
• CVE-2008-0013Heap-based buffer overflow in an unspecified procedure in Tr…
• CVE-2008-0014Heap-based buffer overflow in an unspecified procedure in Tr…