CVE-2018-25028

Name of the Vulnerable Software and Affected Versions libpulse-binding versions prior to 1.2.1

Description The issue is related to use-after-free problems with objects returned by the get format info and get context methods of Stream objects. These objects were mistakenly constructed without setting a flag to prevent the destruction of underlying C objects they reference upon their own destruction. This can cause a use-after-free when get context is called.

Recommendations For versions prior to 1.2.1, update to version 1.2.1 or newer to resolve the issue. As a temporary workaround, consider avoiding the use of the get format info and get context methods of Stream objects until the update is applied.